Where control turns projects into profit

A client asks for an urgent audit of who approved a specific project rate change last month. Or perhaps a former contractor still has an active browser session on their home laptop. In the high-stakes world of professional services, security isn’t just a technical checkbox—it is the foundation of your commercial integrity. If you can’t trust who is accessing your margins, rates, and contracts, you can’t trust your data.

Security in AtomicSam is designed to protect the "commercial truth" of your firm. By ensuring that every action is attributed to a verified user and every data point is isolated, we remove the ambiguity that leads to internal fraud or accidental data exposure. This article covers how to govern access and maintain a high-trust environment across your firm.

Multi-Factor Authentication (MFA)

Passwords alone are no longer enough to protect sensitive client billing data. AtomicSam uses TOTP-based (Time-based One-Time Password) MFA, which requires you to provide a secondary code from an authenticator app (like Google Authenticator, Authy, or 1Password) whenever you sign in from a new device.

To set up MFA for your account:

Navigate to My Profile and select the Security tab.
Click Enable MFA.
Scan the QR code with your chosen authenticator app.
Enter the 6-digit verification code to confirm the link.
Crucial: Download and save your recovery codes in a secure location.

⚠️ Heads up: Recovery codes are the only way to access your account if you lose your phone. AtomicSam support cannot "bypass" MFA for you, as this would create a significant security loophole for your firm's data.

Governing Firm-Wide Access

As a firm leader or admin, you need to know which team members have secured their accounts and which are still relying on passwords alone. The MFA Dashboard provides a bird's-eye view of your team’s security posture.

Status	What it means	Use this when...
Enforced	User cannot access AtomicSam without MFA active.	You want maximum protection for users with "Admin" or "Finance" permissions.
Enabled	The user has opted-in but it is not mandatory.	You are transitioning the team and giving them a grace period to set up apps.
Disabled	The user is only protected by a password.	You are onboarding a new user who hasn't completed their first sign-in.

📸 [Screenshot: The MFA Dashboard showing user status and "Force MFA" toggle]

Commercial Data Isolation & Audit Trails

Your firm’s data is siloed at the database level using Row-Level Security (RLS). This means even though AtomicSam is a cloud platform, your data is isolated from other firms using the system. Within your own firm, access is governed by **Role-Based Access Control (RBAC)**, ensuring a junior designer can enter time without seeing the overhead recovery rates of the senior partners.

Every commercial action in AtomicSam—from changing a quote's status to overriding a billable rate—is captured in an immutable audit trail. These records cannot be deleted or altered. This provides you with total confidence during year-end audits or client disputes; you will always know exactly who touched the numbers and when.

✅ Did you know: You can view the audit history of any specific Quote or Invoice by clicking the History icon in the top right of the record view.

Session Management

AtomicSam uses secure JSON Web Tokens (JWT) to manage your session. To balance convenience with margin protection, we track "last sign-in" location and device data. If you suspect an account has been compromised, or if a team member leaves the firm suddenly, admins can revoke all active heartbeats (sessions) immediately from the **User Management** screen.

📸 [Screenshot: User Management screen showing the "Revoke All Sessions" button]

Pro Tips / Common Gotchas

The "Admin" Trap: Avoid giving everyone "Admin" rights just because it's easier. Each extra admin is a wider doorway for potential revenue leakage or unauthorized rate changes. Use the "Project Lead" role for delivery staff.
MFA for Contractors: If you use external contractors, make MFA a non-negotiable part of their onboarding. They are often working on less secure home networks where the risk of credential theft is higher.
Session Timeouts: If you find you are being logged out too frequently, check if you are using an "Incognito" or "Private" browser window. These windows do not persist your session token correctly, forcing a re-login every time the tab closes.