Rostery
Security2FA / TOTP Authentication

Two-Factor Authentication for NDIS Teams

A six-digit code from an authenticator app on top of the password, with account lockout and breached-password checks to protect participant data.

Book a Demo Live demo
  • Codes from any authenticator app
  • Lockout after failed sign-ins
  • Breached-password check
  • Sessions that expire

Essential Eight

Multi-factor authentication is one of the Australian Cyber Security Centre's Essential Eight mitigation strategies.

Source: Australian Cyber Security Centre

Serious harm

If the Privacy Act covers your organisation, you must notify affected people and the OAIC when a data breach is likely to result in serious harm.

Source: OAIC

APP 11

Organisations must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access.

Source: OAIC

Where account security breaks down

Most account takeovers start with a password someone else already has.

Reused passwords

A password used on another site that was breached opens your system too.

Phishing

A password typed into a fake sign-in page is in someone else's hands within minutes.

Shared logins

One account passed around the office means nobody knows who did what.

Guessing attacks

Scripts try common passwords against every account they can find.

Unattended computers

A session left open on a shared desk is an open door.

Weak passwords

Short passwords and keyboard runs fall to guessing in seconds.

Participant records hold health details, addresses, plans and funding. A stolen password should not be enough to open them. Rostery adds a second step to sign-in: after the password, the user enters a six-digit code from an authenticator app on their phone.

How two-factor authentication works in Rostery

An administrator opens Settings, then Security & MFA, and chooses Enable MFA. Rostery shows a QR code, and the secret for typing in by hand. Scan it with any authenticator app that uses time-based codes, such as Google Authenticator or Authy, enter the six-digit code to confirm, and two-factor sign-in is on. Turning it off again needs the account password.

From then on, signing in to the web app takes the email, the password and a fresh code. The code screen expires after five minutes, and until the code is entered the session can't reach any data. Behind that sit the controls every account gets: lockout after repeated wrong passwords, a password policy that rejects weak and breached passwords, and sessions that end on their own.

How Rostery protects sign-in

1

A code from your phone

Six-digit, time-based codes from any authenticator app. Codes are checked with a small allowance for clock drift, and code attempts are rate-limited.

2

Lockout after repeated failures

Five wrong passwords lock the account for 30 minutes, and repeated failures from the same network address are blocked as well.

3

Passwords that hold up

At least 10 characters. Rostery refuses passwords found in known data breaches (checked without sending your password), long runs of repeated or sequential characters, your own name or email, and obvious words such as ndis or rostery.

4

Sessions that end

Web sessions expire after 12 hours, and signing out ends the session on the server, not just in the browser.

Who it protects

Administrators

Set up two-factor sign-in in Settings, then Security & MFA. Releasing plan management payments requires it.

Office team

Every account gets the password rules, the lockout and sessions that expire.

Support workers

The Rostery app uses the same password rules and lockout, and stays signed in while in use so workers aren't locked out mid-shift.

What a privacy review will look for

Rostery covers the sign-in controls. The last two items are your own processes.

  • Two-factor sign-in on accounts with administrator access
  • Strong passwords that aren't reused from other sites
  • Accounts that lock after repeated failed sign-ins
  • Sessions that time out on shared computers
  • Access removed promptly when staff leave
  • A written plan for responding to a data breach

The rule behind it

Under Australian Privacy Principle 11, organisations covered by the Privacy Act must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. Participant health and disability information is sensitive information, so a second sign-in factor on the accounts that can see it is one of those reasonable steps.

APP 11: security of personal information (OAIC)

Turn on two-factor sign-in in four steps

  1. 1

    Install an authenticator app

    Google Authenticator, Authy or any app that uses time-based codes.

  2. 2

    Open Security & MFA

    In Rostery, go to Settings, then Security & MFA, and choose Enable MFA.

  3. 3

    Scan and confirm

    Scan the QR code and enter the six-digit code the app shows.

  4. 4

    Sign in with a code

    From now on, sign-in asks for the code after your password.

See 2FA / TOTP Authentication on your own data

A guided demo with your participants, staff and price book. No obligation.

Book a Demo

2FA / TOTP Authentication: questions

Any app that uses time-based six-digit codes, including Google Authenticator, Authy and Microsoft Authenticator.

Keep learning

Ready when you are

Ready to transform your NDIS operations?

See Rostery running on your own rosters, funding and award rules — not a canned tour.

Book a DemoSee Pricing
Guided walkthroughYour own dataNo obligation

No setup fees · No obligation · Australian data storage