Skip to main content
Omnivoo handles sensitive financial and personal data: salary information, tax details, bank accounts, and government IDs. This guide covers how to keep your account secure.

​
How Authentication Works

Omnivoo uses a passwordless authentication system. There are no passwords to remember, reset, or leak. Instead, you log in using one of three methods.

​
Email OTP Login

1

Enter your email

Go to app.omnivoo.com and enter your email address in the Work email field.
2

Send the verification code

Click Send verification code. Omnivoo sends a 6-digit one-time passcode (OTP) to your email.
3

Enter the code

Enter the code on the verification screen.
4

You are logged in

You are logged in.
The OTP expires after 5 minutes. If you do not receive the code, check your spam folder. Omnivoo rate-limits OTP requests to 5 per email address within 10 minutes to prevent abuse.
The OTP is sent to the exact email address you entered. Make sure you are checking the right inbox. Omnivoo emails come from @omnivoo.com.

​
Google Sign-In

If you prefer, you can sign in with your Google account:
1

Click Sign in with Google

Go to app.omnivoo.com and click Sign in with Google.
2

Authorize Omnivoo

Select your Google account and authorize Omnivoo.
3

You are logged in

You are logged in.
Google sign-in uses your Google account’s email to match your Omnivoo account. If you have previously logged in with email OTP using the same email address, both methods work on the same account.

​
Passkeys

You can also sign in with Face ID, Touch ID, a fingerprint, or your device PIN. Passkeys are phishing-resistant: unlike an emailed code, a passkey cannot be captured by a fake sign-in page and reused. Add one from My Profile > Security > Passkeys. Signing in with a passkey does not ask for a two-factor code, because it already combines your device with the biometric or PIN that unlocks it. See Passkeys for the full guide.

​
Secondary Email

You can add a secondary email to your account and then log in with either your primary or your secondary address. The new address has to be verified with a one-time code before it works. You manage it from My Profile (avatar menu > Profile) under the Security section. For step-by-step instructions, see Add a secondary email.
A secondary email is an alternate login address, not just a backup contact. After it is verified, an OTP sent to either address can sign you in.

​
Two-Factor Authentication

For an extra layer of protection, you can turn on two-factor authentication (2FA). With 2FA enabled, signing in also requires a 6-digit code from an authenticator app (or a one-time recovery code). You enable and manage 2FA from My Profile > Security. See Two-Factor Authentication for the full setup and recovery-code guide.

​
Active Sessions

The Security section also lists your Active Sessions: every device currently logged into your account, with its browser, location, and when it was last active. Your current device is tagged Current.
  • To sign out one device, click Revoke next to it. The rest of your sessions stay logged in.
  • To end every session at once, click Logout from all devices and confirm. This signs you out everywhere, including your current device, and you will need to log in again on each one.
Employers find this under My Profile (avatar menu > Profile) > Security. EOR employees find it on the Profile page in the sidebar, in the Security card. Contractors find it on the Security tab of their profile. See Session & Security for more on how sessions work.

​
How Sessions Work

Omnivoo uses HTTP-only cookies for authentication. When you log in:
  1. A signed token is stored in an HTTP-only cookie on your browser.
  2. Every request to Omnivoo automatically includes this cookie.
  3. When the access token nears expiry, Omnivoo automatically refreshes it in the background, so you are not interrupted.
  4. If your session is revoked or expires, you are logged out and must log in again.
Because tokens are stored in HTTP-only cookies, they cannot be read by JavaScript running on the page, which protects against cross-site scripting (XSS) attacks.

​
Security Best Practices

  • Do not share your OTP codes: Omnivoo support will never ask for a login code.
  • Add a passkey: the strongest option available. A passkey cannot be phished, because it only works on the real Omnivoo site. See Passkeys.
  • Turn on two-factor authentication: especially for employer accounts with admin access.
  • Lock your devices: use a screen lock on any computer or phone where you access Omnivoo.
  • Log out on shared devices: always sign out when using a shared or public computer, or use Logout from all devices.
  • Verify emails: Omnivoo emails come from @omnivoo.com. Be cautious of phishing from other domains.

​
Account Lockout Protection

To prevent brute-force attacks:
  • After 5 failed attempts on a single OTP, that code is invalidated. You must request a new one.
  • After 15 failed attempts across all codes within 30 minutes, your account is temporarily locked. Wait and try again later.

​
Data Protection

Omnivoo protects your data with:
  • Encryption in transit: all connections use TLS.
  • Encryption at rest: sensitive data (such as bank details and government IDs) is encrypted in the database.
  • Access controls: role-based permissions limit who can view sensitive information.
  • Data retention: records are retained per applicable legal requirements.

​
Reporting Security Issues

If you notice suspicious activity on your account or a potential security vulnerability:
  1. Use Logout from all devices to end every active session immediately.
  2. Contact security@omnivoo.com with details of what you observed.