Protect Access to Wellhub for Companies Your Way

Wellhub for Companies now gives you three added ways to control access to your HR admin platform: authenticator app verification, SFTP keys with granular permissions, and single sign-on (SSO) as an optional add-on feature. 

🔒 SSO: access managed from your own system

Choose to enable SSO so your team signs in to Wellhub for Companies through your company’s own sign-in system, such as Microsoft Entra, Okta, or Google Workspace.

• Your policies apply at sign-in: Staff users are verified by the system your company already trusts and manages.
• Access changes happen once: When your IT team removes someone from your identity provider, that person can no longer sign in to Wellhub for Companies.
• One less password: Staff users use their existing work credentials.

Staff users still need an invitation to Wellhub for Companies. SSO confirms who they are but doesn’t grant access by itself. This is an optional add-on feature. Speak with your client manager for more details. 

🔑 Authenticator apps: a second check at login

Staff users can add a second verification step with a 6-digit code from an app like Google Authenticator, Microsoft Authenticator, or Authy.

• Codes generated on the device: They refresh every 30 seconds and work without a mobile signal or internet connection.
• Your choice for the whole team: Admin and Technical staff users can set the method for everyone in Settings > Multi-factor authentication, and can return to emailed codes at any time.
• Recovery codes included: Staff users save a set of codes during setup, so a lost device doesn’t have to mean a lost login.

🗝️ SFTP keys: only the access each vendor needs

If you connect Wellhub to other systems through SFTP, each new key can be limited to a specific flow. 

• Choose access per flow: For Eligibility, Payroll, Reports, and Flexible Benefits, pick No access, Read only, or Read and write. You see only the flows your contract includes.
• Limit what any one key can reach: A key for your payroll provider can read payroll and nothing else, so information stays in the right hands.
• Adjust as things change: Edit a key’s permissions or remove the key. Removal takes effect immediately.
• Two-factor on key actions: Creating, editing, or removing a key uses a two-factor check.