> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.digitalpurchaseorder.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Security best practices - Old DPO Design

Protecting financial data and user access is a top priority at DPO. Follow the best practices below to keep your account secure.

||| **Already using DPO's new design?** [You can find the corresponding article here](https://help.digitalpurchaseorder.com/en/article/security-best-practices-in-dpo-82kt2p/)

###### Protecting Your DPO Account

[**Enable MFA**](#6-enable-multi-factor-authentication-mfa)
Use two-step verification to add an extra layer of security to your login.

[**Manage Passwords**](#6-change-passwords-regularly)
Update passwords regularly and use strong credentials.

[**Set Password Policies**](#6-configure-a-custom-password-policy)
Enforce book-level security rules to strengthen access control across your organization.


###### Enable Multi-Factor Authentication (MFA) 
*Multi-Factor Authentication (MFA) adds an additional layer of protection to your account. With MFA enabled, you must verify your identity using a second factor (such as a mobile authentication app) in addition to your password.*

**Why MFA is important:**

* Protects against stolen or leaked passwords
* Prevents unauthorized account access
* Reduces risk of phishing attacks

**To enable MFA:**

1. Go to **Account Settings**
2. Navigate to **MFA**
3. Activate **Multi-Factor Authentication**
4. Follow the setup instructions
*We strongly recommend enabling MFA for all users, especially administrators and approvers*

Administrators can also enforce MFA at Book level under: **Admin → Password Policy**

|| Note: Each user must still activate MFA individually in their profile.


![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/image_1na3bgp.png =902xauto)


###### Use Strong, Unique Passwords
*Your password is your first line of defense.*

We recommend creating passwords that:

1. Contain at least **12 characters**
2. Include uppercase and lowercase letters
3. Include numbers and special characters
4. Are not reused across other services
5. Do not contain personal information or company names

**Avoid simple passwords such as:**

* Simple passwords like `Password123`
* Company name + year
* Reused passwords from other systems

Strong passwords significantly reduce the risk of unauthorized access.

###### Change Passwords Regularly
*Regular password updates help reduce the risk of long-term exposure.*

We recommend changing passwords:

1. Periodically based on your company’s internal security policy
2. Immediately if suspicious activity is detected
3. After any known credential exposure

**To change your password:**

1. Go to **Account Settings**
2. Enter your **Current** and your new secure password
3. Confirm your new password 
4. Click **Save** to apply the changes 


![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/screenshot-2026-02-17-at-09534_19todme.png =807xauto)



###### Configure a Custom Password Policy
*Administrators should configure a password policy to strengthen account security and protect financial data.*

1. Go to **Admin → Password Policy**.

![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/screenshot-2026-02-17-at-10031_1238nz7.png =921xauto)


2. Enable **Require MFA** to enforce multi-factor authentication for your Book.
*(Each user must activate MFA individually in their Profile.)*


![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/screenshot-2026-02-17-at-10125_75relk.png =889xauto)


3. Define password requirements for **User** and **Administrator** roles 
4. Set minimum length, complexity, and expiration period


![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/screenshot-2026-02-17-at-10164_1ui0pcz.png =900xauto)


5. Use **Advanced Settings** to **require special characters**, uppercase/lowercase letters, or numbers.


![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/screenshot-2026-02-17-at-10242_8operc.png =978xauto)


5. Add **banned words** to prevent weak or predictable passwords (e.g., company name or common terms).

 ![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/f/8/7ef8b3dbb012a000/screenshot-2026-02-17-at-10271_1a1nosu.png =1050xauto)

**Recommended policy guidelines:**

* **Minimum** password length of at least **12 characters**.
* **Complexity** requirements (letters, numbers, symbols).
* **Mandatory MFA** for sensitive roles.

*These measures significantly reduce the risk of unauthorized access.*


###### Monitor Account Activity

Encourage users to:
* Report unusual login attempts
* Review approvals and changes regularly
* Inform administrators if suspicious behavior is detected
Early detection helps prevent security incidents.


###### Summary of Recommendations

For maximum security when using DPO:

✔ Enable Multi-Factor Authentication
✔ Use strong, unique passwords
✔ Change passwords regularly
✔ Implement a password policy
✔ Assign permissions responsibly
✔ Monitor account activity




**Any Questions?**
Our support team is happy to help:

Email: support@digitalpurchaseorder.com
Phone: +1 888 376 7254

[Or schedule a free demo](https://calendly.com/d/gpk-ppc-rjg) – we look forward to hearing from you.