Requiring two-factor authentication for the whole team often clashes with reality: not everyone has an authenticator app installed, and not all devices have a fingerprint reader. BionicAdri solves this with 3 verification methods to choose from, so that security does not depend on everyone using exactly the same device or the same app.
3 methods, a single policy
The two-step authentication system allows you to enable the method that best suits each person or device, without sacrificing the level of security required by the company:
Authenticator App (TOTP)
Compatible with Google Authenticator, Microsoft Authenticator or any app based on the TOTP standard. A one-time code that changes every 30 seconds.
Biometrics (WebAuthn)
Fingerprint, Face ID or Windows Hello, depending on the device. A single touch or glance, without typing any code.
Code via WhatsApp + Email
The same verification code is sent in parallel to WhatsApp and email. If one channel fails, the other keeps working.
Biometrics without additional hardware
Biometric verification uses the WebAuthn standard, the same one used by major browsers and operating systems to recognise fingerprint, face or device PIN. There is no need to buy any physical key or install additional software: if the computer or mobile already has a biometric sensor, it works directly from the browser.
This method is especially convenient for daily use because it does not interrupt the workflow with codes you have to copy: one tap and you're in.
The Messaging Method: Redundancy by Design
One of the most practical aspects of the system is the messaging verification method. Instead of relying on a single channel that could fail (for example, if WhatsApp is down or email is slow to arrive), the same code is sent simultaneously via WhatsApp and Email. If one of the two channels does not arrive, the other remains available, and the user never gets locked out of their account because of a one-off delivery issue.
Configurable Policy by Role
Not all companies need the same level of enforcement for all user profiles. Administration can define, for each role within the organisation, whether two-factor authentication is:
- Disabled: no additional requirement
- Optional: the user can enable it voluntarily
- Mandatory: the user must configure at least one method, with a configurable grace period before it is required of them
This allows, for example, mandatory MFA to be required for profiles with access to sensitive or financial data, while leaving it optional for roles with more limited access.
Trusted Devices and Recovery Codes
To avoid asking for the second factor on every login from the same usual computer, the system allows you to mark a device as "trusted" for a set period. This marking can be revoked at any time by the user themselves, in case the device is lost or shared.
When you activate the first verification method, single-use recovery codes are generated automatically, intended for cases where you lose access to your main method (for example, changing phone). Each code can only be used once.
Designed Not to Lock Anyone Out
A security system that leaves people out of their own account creates more friction than protection. That's why the design includes several safeguards: you cannot remove the last verified method if the company policy requires mandatory two-factor authentication, and the messaging channel degrades in a controlled way (if WhatsApp is unavailable at a given moment, email still arrives).
Conclusion
Access security does not have to be rigid or depend on a single method. Offering three options (app, biometrics, messaging) with a role-configurable policy lets each company adjust the level of requirement to its reality, without sacrificing convenience or leaving anyone locked out.
Do you want to see how it is configured for your team? Request a demo or write to us at [email protected].
- Security
- MFA
- WebAuthn
- Biometrics