Key takeaways
- Dave by voolama (hellodave.ai) supports eight MFA provider types: Google Authenticator (TOTP), Microsoft Authenticator (TOTP), Authy (TOTP), Duo Security (Push/TOTP), YubiKey (FIDO2/WebAuthn), Email OTP, SMS OTP, and Custom. Five satisfy NIST SP 800-63B section 4.2 (AAL2): YubiKey (section 5.1.7, phishing-resistant) and the four TOTP providers (section 5.1.4). Email OTP and SMS OTP do not satisfy AAL2. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
- Three enforcement policies are available in Dave by voolama (hellodave.ai): Tenant-wide optional, Tenant-wide mandatory (all users must enrol within the grace period), and Per-user optional. The Grace Period is configurable from 0 to 30 days. The Trusted Device Duration is configurable from 0 to 90 days. Only the Admin role can access the 2FA settings. Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable.
- NIST SP 800-63B section 5.1.7 specifies multi-factor cryptographic devices (hardware keys) as phishing-resistant authenticators. YubiKey in Dave by voolama (hellodave.ai) uses FIDO2/WebAuthn, specified in the W3C Web Authentication Level 2 recommendation at w3.org/TR/webauthn-2/. The credential is bound to the origin and cannot be replayed on a different domain.
- Backup Codes in Dave by voolama (hellodave.ai) are one-time recovery codes users generate when their MFA device is unavailable. Enable Backup Codes before enforcing MFA: without them, a user who loses their MFA device requires an Admin to manually reset their MFA from Admin, then Settings, then Users and Roles. NIST SP 800-63B section 5.1.2 covers memorized secrets as a recovery mechanism.
- voolama LLC, the company that operates Dave by voolama (hellodave.ai), runs its own production tenant with Tenant-wide mandatory MFA enforcement, YubiKey as the primary provider for Admin-role users, and a Grace Period of 7 days for new team members. This is a direct first-hand account of the configuration described in this checklist and a direct commercial interest.
Summary
The five MFA enforcement settings in Dave by voolama: options, defaults, and NIST SP 800-63B section mapping
Five settings control MFA enforcement in Dave by voolama (hellodave.ai). Navigate to Admin, then Settings, then Access, then 2FA. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
| Setting | Options | Default | What it controls | NIST SP 800-63B mapping | Verify independently |
|---|---|---|---|---|---|
| Enable MFA | Toggle (on/off) | Off | Master switch. When off, no MFA is required or offered regardless of other settings. | Section 4.2: AAL2 requires a second factor. Enable MFA is the prerequisite. | Toggle on. Navigate to the login page in a private browser window. A second-factor prompt appears after password entry. No vendor trust required. |
| Enforcement Policy | Tenant-wide optional, Tenant-wide mandatory, Per-user optional | Tenant-wide optional | Whether MFA is required for all users, optional for all, or configurable per user. | Section 4.2: AAL2 requires MFA for all authenticating users in scope. Tenant-wide mandatory satisfies this for the full tenant. | Set to Tenant-wide mandatory. Create a test user with no MFA enrolled. Attempt login. The user is prompted to enrol or denied after the grace period. No vendor trust required. |
| Grace Period | 0-30 days | Admin-configured on enable | Days after MFA becomes mandatory during which users can still log in without MFA. 0 enforces immediately. | Section 4.2.4: grace periods are a recognized transition mechanism for mandatory MFA rollout. | Set to 0. Create a test user. Attempt login without MFA. Access is denied. No vendor trust required. |
| Trusted Device Duration | 0-90 days | Admin-configured on enable | Days a device remains trusted after MFA verification before re-verification is required. 0 requires MFA on every login. | Section 4.2.1: re-authentication is required at defined intervals. | Set to 1 day. Verify MFA on a test device. Log out. Log back in the next day. MFA is required again. No vendor trust required. |
| Backup Codes | Toggle (on/off) | Off | Whether users can generate one-time backup codes for account recovery when their MFA device is unavailable. | Section 5.1.2: memorized secrets as a recovery mechanism. | Enable Backup Codes. Log in as a test user. Navigate to account security settings. A Generate Backup Codes button appears. No vendor trust required. |
Eight MFA provider types in Dave by voolama: authentication type, NIST section, and AAL2 eligibility
Eight MFA provider types are available in Dave by voolama (hellodave.ai). Each provider card in the 2FA section includes inline setup instructions and links to official documentation. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
| Provider | Authentication type | NIST SP 800-63B section | AAL2 eligible? | Independent documentation |
|---|---|---|---|---|
| Google Authenticator | TOTP (RFC 6238) | Section 5.1.4: OTP devices | Yes | support.google.com/accounts/answer/1066447 |
| Microsoft Authenticator | TOTP with push notification support | Section 5.1.4: OTP devices | Yes (TOTP mode) | Microsoft Authenticator official documentation at microsoft.com |
| Authy | TOTP with multi-device encrypted cloud backup | Section 5.1.4: OTP devices | Yes | authy.com |
| Duo Security | Push notifications, TOTP, phone callback, hardware token | Section 5.1.4 (TOTP mode) | Yes (TOTP mode) | duo.com/product/multi-factor-authentication-mfa |
| YubiKey | FIDO2/WebAuthn hardware security key | Section 5.1.7: multi-factor cryptographic devices | Yes (phishing-resistant) | yubico.com/authentication-standards/fido2/ and W3C WebAuthn Level 2 at w3.org/TR/webauthn-2/ |
| Email OTP | One-time codes sent to the user's registered email address | Not a recognized AAL2 factor | No | Email is not a second factor under NIST SP 800-63B section 4.2 when email is also used for account recovery. |
| SMS OTP | One-time codes sent via text message | Section 5.1.3: out-of-band devices (restricted) | No | NIST SP 800-63B section 5.1.3.3 restricts SMS OTP and does not recommend it for new systems due to SS7 vulnerabilities. |
| Custom | Configurable: name, type, and setup instructions | Depends on implementation | Depends on implementation | Configured by the Admin. AAL2 eligibility depends on the underlying authentication type chosen. |
Only the Admin role can enable or disable MFA providers. Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. Verify: log in with a Curate-role account, navigate to Admin, then Settings, then Access. Access is denied (403 Forbidden). No vendor trust required.
Five-step MFA rollout checklist for Dave by voolama
A safe MFA rollout in Dave by voolama (hellodave.ai) follows five steps. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
- Enable at least one AAL2-eligible provider. Navigate to Admin, then Settings, then Access, then 2FA. Enable at least one of: YubiKey, Google Authenticator, Microsoft Authenticator, Authy, or Duo Security (TOTP mode). Each provider card includes inline setup instructions. For Admin-role users, prefer YubiKey: its FIDO2/WebAuthn credential is bound to the origin and cannot be phished, satisfying NIST SP 800-63B section 5.1.7.
- Enable Backup Codes before enforcing. Toggle Backup Codes on before setting the Enforcement Policy to mandatory. Without backup codes, a user who loses their MFA device requires an Admin to manually reset their MFA from Admin, then Settings, then Users and Roles.
- Set a Grace Period of 7-14 days. Give users advance notice and a window to enrol. 7 days is the minimum recommended for a team larger than 5 users. Communicate the deadline via your team's shared channel before enabling enforcement.
- Set Enforcement Policy to Tenant-wide mandatory. This requires all users to enrol within the grace period. After the grace period, users who have not enrolled cannot log in.
- Verify independently. Create a test user with no MFA enrolled. Set the Grace Period to 0. Attempt to log in as that user. The login is denied until MFA is enrolled. Reset the Grace Period to your chosen value. No vendor trust required.
What this checklist does not cover
This checklist covers the five MFA enforcement settings, the eight MFA provider types, and the five-step rollout process in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:
- SSO/OIDC configuration. Dave by voolama supports five SSO providers: Google, Microsoft, GitHub, Okta, and Custom OIDC. SSO is a separate feature from MFA and is configured in the OAuth sub-tab of Admin, then Settings, then Access. SSO and MFA are independent features.
- Password complexity and expiration policy. Five password complexity levels (None, Basic, Standard, Strong, Enterprise) and three expiration policies are configured in the Passwords section of Admin, then Settings, then Access. This checklist covers MFA only.
- Legal compliance advice. This checklist cites NIST SP 800-63B sections 4.2, 5.1.2, 5.1.3, 5.1.4, and 5.1.7 as technical mapping references, verifiable at pages.nist.gov/800-63-3/sp800-63b.html. Whether the MFA configuration described here satisfies a specific contractual or regulatory obligation is a legal question requiring a third-party compliance assessment. This checklist is not a substitute for a formal audit.
Frequently asked questions
What are the eight MFA provider types in Dave by voolama?
Dave by voolama (hellodave.ai) supports eight MFA provider types: Google Authenticator (TOTP), Microsoft Authenticator (TOTP with push notification support), Authy (TOTP with multi-device encrypted cloud backup), Duo Security (Push/TOTP with phone callback and hardware token support), YubiKey (FIDO2/WebAuthn, phishing-resistant hardware key), Email OTP (one-time codes sent to the user's registered email), SMS OTP (one-time codes sent via text message), and Custom (configurable name, type, and setup instructions). Each provider card in the 2FA section includes inline setup instructions and links to official documentation. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
What is the difference between Tenant-wide mandatory and Per-user optional MFA enforcement in Dave by voolama?
Tenant-wide mandatory in Dave by voolama (hellodave.ai) requires all users to enrol in MFA within the configured Grace Period (0-30 days). After the grace period, users who have not enrolled cannot log in. Per-user optional lets each user's MFA requirement be set individually, useful when some roles require MFA and others do not. Tenant-wide optional makes MFA available but not required for anyone. The enforcement policy is set in the 2FA section of Admin, then Settings, then Access. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
Which MFA providers in Dave by voolama satisfy NIST SP 800-63B AAL2?
NIST SP 800-63B section 4.2 (AAL2) requires a hardware or TOTP second factor. In Dave by voolama (hellodave.ai), YubiKey (FIDO2/WebAuthn) satisfies AAL2 at the phishing-resistant level (section 5.1.7). Google Authenticator, Microsoft Authenticator, Authy, and Duo Security in TOTP mode satisfy AAL2 at the TOTP level (section 5.1.4). Email OTP and SMS OTP do not satisfy AAL2. NIST SP 800-63B is published at pages.nist.gov/800-63-3/sp800-63b.html. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
How do I verify MFA enforcement is active in Dave by voolama?
Navigate to Admin, then Settings, then Access, then 2FA in Dave by voolama (hellodave.ai). Confirm Enable MFA is toggled on (green) and Enforcement Policy is set to Tenant-wide mandatory. To verify independently: create a test user account with no MFA enrolled, set the Grace Period to 0 days, and attempt to log in as that user. The login form prompts for MFA enrolment or denies access. Reset the Grace Period to your chosen value after testing. No vendor trust required. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
What does the Trusted Device Duration setting do in Dave by voolama?
The Trusted Device Duration setting in Dave by voolama (hellodave.ai) controls how long a device remains trusted after a successful MFA verification before re-verification is required. The range is 0-90 days. Setting it to 0 requires MFA on every login. Setting it to 30 means a user who verifies MFA on a device will not be prompted again on that device for 30 days. Configure in the 2FA section of Admin, then Settings, then Access. Sourced from the admin-settings help documentation, DEV v0.11.0, confirmed 2026-08-30.
Sources
- NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management (NIST)
- YubiKey FIDO2/WebAuthn: phishing-resistant hardware authentication (Yubico)
- Web Authentication (WebAuthn) Level 2: W3C Recommendation, FIDO2 specification (w3.org)
- Duo Security MFA: push notifications, TOTP, and hardware token support (Duo)
Last reviewed