What is two-factor authentication (2FA)?

Two-factor authentication (2FA) is a security method that asks for a second proof in addition to the password when signing in to an account. The password is "something you know", and the second step is most often "something you have", meaning the authenticator app on your phone. Even if the password is somehow stolen, the account cannot be accessed without the second step.

How does two-factor authentication work?

The user first enters their password, then in the second step types the code the authenticator app on their phone is generating at that moment. The system compares the code with the value it calculates on its side, and if they match, sign-in is completed. The code becomes invalid after a short time, so seeing it once is not enough to reuse it.

The most common standard for these codes is TOTP (Time-Based One-Time Password). RFC 6238 (May 2011) defines the algorithm, with a default time step of 30 seconds. The authenticator app and the server independently generate the same code from the secret key shared at setup and the current time.

Why does 2FA matter in a corporate travel portal?

In a corporate travel portal some accounts do more than book: they approve requests, change budgets and policies, and see invoices and wallet movements. If the password of such an account is stolen, the impact is not limited to a single trip. Employee profiles also hold personal data such as ID number (masked), passport and contact details. Two-factor authentication is the most direct way to reduce this risk, especially on accounts with approval and finance permissions.

Which sign-in methods are used?

An extra proof at sign-in can be requested through different channels, or another method can replace the password; each method has a different level of security. The methods most often seen in corporate portals are these:

How is two-factor authentication done in Kurumsal.pro?

In the portal your agency offers its corporate clients, 2FA uses a 6-digit code generated by an authenticator app. Employees start setup from the Security tab of the My Profile screen; they scan the QR code on the screen with the app, or enter the key manually, then complete setup with the code the app generates.

• The verification step requested at sign-in is valid for 5 minutes, with a maximum of 5 attempts.
• The Security tab shows the 2FA status, registered passkeys and last sign-in information.
• A password must be at least 10 characters and contain upper-case and lower-case letters and a digit.
• In the default setting, 5 consecutive failed sign-ins lock the account for 15 minutes; the response does not reveal whether the account exists.

A passkey is the way to passwordless sign-in: the employee signs in with the device lock. Passkey sign-in also passes through the account lockout and account status rules.

For which roles is 2FA mandatory?

In the corporate portal, 2FA is made mandatory by role. By default it is mandatory for the Company Admin, Finance and Approver roles, and this cannot be switched off for the Company Admin. The company administrator changes the requirement and the idle timeout (15, 30 or 60 minutes) for the ready-made roles from the portal's security screen. The company switches the requirement on or off separately per role for the roles it defines itself.

If an employee loses or changes their phone, the company administrator resets 2FA from the account actions on the employee's record. Role management and account actions are covered on the company admin panel page.

Is two-factor authentication the same as SSO?

No. Two-factor authentication strengthens the sign-in itself, while SSO lets a user reach many applications in a single session through the company's identity system. The Kurumsal.pro portal has no SSO sign-in; sign-in uses email and password, an authenticator app and a passkey. All the security layers of the portal are on the security page, and the general framework for protecting traveller data is in the article on data protection (KVKK and GDPR).