At Wamly, security is integrated into every layer of the hiring process to ensure that sensitive organisational and candidate data remains protected. Our security framework relies on a combination of industry-standard authentication protocols — including Single Sign-On (SSO) for enterprise environments and Multi-Factor Authentication (MFA) — alongside a granular permissions system built on seats, roles, role levels and groups. By centralising security management under the My Organisation tab, Organisation Administrators can maintain a complete audit trail via the Activity History module, ensuring that every administrative change is tracked and that data access is restricted solely to the departments and projects where it is required.
Login Methods: Under Login Options, choose which methods users may use to sign in to your organisation — Email & Password and/or Google.
Multi-Factor Authentication (MFA): If enforced by the organisation, users must set up MFA via a secondary email or SMS. Wamly recommends using SMS as most workers have easier access to phones than personal email.
Single Sign-On (SSO): Available for Enterprise-level organisations, this allows users to access Wamly via their company's identity provider (e.g. Azure AD or Google Workspace).
For detailed steps on setting up your Single Sign-On (SSO), see this article.
Password Requirements: Passwords must be at least 8 characters and include a number, special character, and both uppercase and lowercase letters.
OTP Verification: 6-digit One-Time Pins (OTP) are used during signup, password resets, and manual login attempts to verify email access.
Security Tab: Only Organisation Administrators can access global security settings under the MY ORGANISATION tab.
Activity History: This is the only module currently providing a front-end audit log, allowing users to see every update made to security settings and by whom.
User Records: Users can never be deleted, only deactivated, because their profiles are required to maintain the platform's audit trail.
Candidate Consent: For background checks, candidate data and consent are collected upfront. Only users with the relevant permissions can view or download the generated PDF consent documents for audit purposes.
Permission Layers: Security is maintained by limiting visibility based on each user's seat, roles, role levels and group memberships.
Department Isolation: Users are restricted to data within the departments their roles are scoped to (a Department role level), preventing unauthorised access to other areas of the organisation.
Sensitive Data Visibility: A Project Admin can hide specific sensitive information, such as psychometric or background check results, at the project level.
For a full explanation of how permissions work in Wamly, see the User Permissions Guide.