Sign-in security
Two-step sign-in
HireBest supports two-step sign-in with an authenticator app. The app makes time-based one-time passwords (TOTP, RFC 6238): a 6-digit code that changes every 30 seconds. Any standard authenticator app works, for example Google Authenticator, Microsoft Authenticator or 1Password.
- Each user can turn it on for their own account.
- A user can add up to 10 authenticators, for example a second phone.
- HireBest asks for a code at every sign-in. There is no "remember this device".
- HireBest does not send codes by SMS, phone call or email.
- HireBest limits code attempts and blocks repeated wrong codes for a short time.
- To remove an authenticator, the user types a current code from that authenticator.
Organization requirement
Super Admins and Admins can require two-step sign-in for their organization. It is off by default.
- The requirement applies at once. A member without an authenticator must set one up before they can open any HireBest page.
- Phones that are already paired and AI-assistant connections that already exist keep working until you revoke them.
- An administrator can switch the requirement on only after they use two-step sign-in themselves.
- Strictest organization wins. One sign-in serves all the organizations a person belongs to. If any of them requires two-step sign-in, the person uses it everywhere.
- Each change of the setting is recorded in an audit log.
- When the requirement is on, phones that members pair with HireBest must be approved from a browser session that used a code.
Recovery
HireBest does not issue recovery codes. A user who loses their only authenticator contacts support@hirebest.ai. HireBest support confirms the person's identity before it removes the person's authenticators. The person then sets up two-step sign-in again. For a member of an organization that requires two-step sign-in, support also confirms with an administrator of that organization. Organization administrators cannot remove another person's authenticator, because one person can belong to several organizations.
HireBest staff
Every HireBest staff member who can open HireBest's internal operations tools must use two-step sign-in. There is no setting to turn this off.
Single sign-on
HireBest does not support sign-in through a company's own identity provider (SAML single sign-on) today. Contact support@hirebest.ai if your organization needs it.