Safety of use of eFOB
Data security in the eFOB depends on how you sign in, protect your devices and assign permissions. Below are recommendations for eFOB users and administrators.
Basic safety rules
Here are some specific tips and recommendations on the safe use of the employee documents in eFOB.
Avoid access from untrusted devices and networks, as well as from public places:
Use eFOB only from trusted devices and secured Wi-Fi networks. Avoid logging in from public computers or open networks, which may be vulnerable to attacks.
Update your software regularly, especially browsers:
Ensure that the software used to view the employee documents in eFOB, including the web browser and operating system, is always up to date. Updates often include security patches that prevent vulnerabilities from being exploited.
Be careful with attachments and links:
Do not open attachments or click on suspicious links from unknown or suspicious sources, including those that may pretend to be communications from the eFOB system. Phishing attacks can use seemingly legitimate messages to steal your login details or install malware.
Log out after session ends:
After you finish working with eFOB, remember to log out of your account, especially if you are using a computer or device that is used by other people.
Know the data protection rules:
Please read the applicable provisions on the protection of personal data to be aware of your rights and obligations regarding the processing of data in the employee documents in eFOB, including those applicable in your organization.
Integrated identity management in the company
Whenever possible, use your company's identity provider (IdP).
Once eFOB is connected to the company IdP, users can sign in with their company accounts without having to remember a separate password for eFOB. Depending on the configuration, they may also need to enter their passwords less often.
Password security
If you sign in to eFOB with a username and password, use a strong, unique password and add protection to your account.
Enable two-factor authentication (2FA) to add protection to your account. Once enabled, logging in requires both your password and a one-time code from an authenticator app. For setup and login instructions, see Two-factor security (2FA) in eFOB.
Long passwords and data security:
Passwords that are at least 12 characters long provide a much stronger security barrier because they increase the number of possible combinations. The longer the password, the more difficult it is to crack it using hacking methods.
Rules for creating secure passwords:
In addition to length, it's also a good idea to use a variety of characters, such as uppercase and lowercase letters, numbers, and special characters, to increase the complexity of your password.
TIP: Avoid using easy-to-guess phrases or personal information, such as your name or date of birth, that can be easily found by hackers.
Password Management:
It's a good idea to use password management tools that allow you to store and generate strong passwords.
Use a different password for each service. Change it immediately if you suspect it has been exposed or your account has been compromised, and follow your organization's password policy.
Do not share passwords with third parties:
Passwords can be intercepted through any digital communication channel.
Don't share your account passwords with third parties, even if they seem to have good intentions.
You can change your eFOB account password in Application settings. If you have forgotten it, follow the account recovery instructions. If you sign in with a company account, change your password through your identity provider.
Protecting downloaded files
Downloaded documents and exports may contain personal data. Store them only in locations approved by your organization, share them only with authorized people and remove unnecessary copies according to company rules. Do not send them to personal email accounts or personal cloud storage.
Suspected account compromise or loss of access
- Report suspicious logins, exposed login details or a lost device to your organization's eFOB administrator immediately. If the incident involves a company account, also notify your IT department.
- If you suspect your password has been exposed, change it. For a company account, do this through your identity provider. If you cannot log in, contact your administrator to secure the account and recover access.
- If you lose your phone or access to your authenticator app, follow Two-factor security (2FA) in eFOB. Resetting 2FA settings requires help from an administrator.
Never share your password, 2FA codes or authenticator setup code, including when contacting technical support. Describe the incident and its approximate time in your report, without attaching personal data or confidential documents.
For administrators and people managing access
Company identity provider (IdP)
If your company uses an identity provider, an administrator can connect it to eFOB and manage sign-in policies in one place.
Depending on the IdP configuration:
- the administrator can limit sign-in to selected locations (e.g. Poland) and devices (e.g. company-managed computers),
- the administrator can set requirements for password strength and changes,
- the administrator can block a user's access to connected systems at the same time.
eFOB supports integration with Google and Microsoft identity providers. If you need another integration, contact the sales department.
The IdP controls sign-in to eFOB. Subsequent actions in the application take place outside its control. If you need additional access restrictions, such as an IP allowlist, contact us.
For instructions on configuring available login methods, see Users.
Actual access control
After configuring sign-in, check user permissions. Administrators should regularly verify what access a user receives in practice. They can use the Effective permissions panel in user administration to see the result of combining module access roles (MDL), data access roles (DS) and additional security rules.
This analysis helps:
- detect overly broad access to documents, cases or administrative functions,
- check which role grants a specific user action,
- prepare for an audit or periodic permission review,
- verify access after a change of position, team or responsibilities.
The permission to run this analysis should be granted only to administrators responsible for security and access control.
For configuration details, see Module access permissions (MDL) and Data access permissions (DS). Instructions for the Effective permissions panel are available in Users.
Changed responsibilities and offboarding
When a user's position or responsibilities change, review their roles and retain only the access needed for their current work. When cooperation ends, block the account or remove access to the relevant company according to your organization's procedure. Also review access through the company account at the identity provider.
For account blocking and access management, see Users.
Login history, changes and document access
Administrators should check unusual login attempts and unexpected changes to user data or permissions. A user's history includes successful and failed logins, data changes and permission changes; see Users for instructions.
To investigate document access, use the document audit, which shows changes and file views. For periodic access reviews, use the permission changes audit report described in Reporting.
Report permissions
Review report permissions separately from access to other modules. Reports may include the full data for their area, regardless of restricted views in other modules. For details, see Reporting.