Two-factor authentication
Spa accounts combine guest treatment histories, contact details and payment information — data your guests expect you to keep secure. Xircuit's two-factor authentication ensures staff and admin access is protected beyond a password alone.
Request a demoXircuit's two-factor authentication uses time-based one-time passwords (TOTP) from any authenticator app — Google Authenticator, Microsoft Authenticator or Authy. Every account stays protected against credential-stuffing attacks even if a password is ever compromised.
Works with Google Authenticator, Microsoft Authenticator, Authy and any standard TOTP app — no proprietary hardware required.
Even if a password is exposed in a third-party breach, 2FA blocks unauthorised access to Xircuit accounts.
Users set up 2FA from their own profile page in under two minutes — no admin intervention required.
Org admins can require 2FA for all staff logins, ensuring consistent security across the whole team.
TOTP codes are generated locally on the user's device — no SIM-swap risk and no reliance on phone signal.
Day spas and wellness centres that enforce 2FA for all staff logins typically remove the risk of credential-based access to guest data entirely — and commonly find that guests respond positively when informed that their data is protected with multi-factor authentication.
Xircuit supports any standard TOTP authenticator app, including Google Authenticator, Microsoft Authenticator and Authy. You scan a QR code once during set-up and the app generates codes automatically.
Yes. Org admins can enforce 2FA for all staff roles from the organisation security settings. Users without 2FA set up will be prompted to enrol before accessing their account.
Users receive recovery codes when they set up 2FA. An org admin can also disable 2FA for a specific account via the admin panel so the user can re-enrol.