Always sign in from a trusted source
Take care when accessing SuperControl, particularly from search results or online advertisements.
To help protect your login details:
- Access SuperControl through the official SuperControl website or a trusted bookmark.
- Check the website address before entering your login details.
- Avoid signing in from unfamiliar links or advertisements.
- Consider bookmarking the SuperControl sign-in page for quick access.
Use a strong, unique password
Your SuperControl password must:
- Be at least 12 characters
- Include at least one uppercase letter
- Include at least one lowercase letter
- Include at least one number
- Include at least one special character, such as
!,@,#or$ - Not be one of your previous 24 passwords
Your password will also be checked against commonly used and known compromised passwords.
Do I need to change my password regularly?
There is no need to change your password simply because a set period of time has passed.
You should change your password if:
- You think someone else may know it
- You have accidentally shared it
- You have used the same password on another service that may have been compromised
- SuperControl asks you to reset it for security reasons
Should I use a password manager?
Remembering a different strong password for every online service can be difficult.
A reputable password manager can help you create and securely store unique passwords without having to remember each one.
If you use a password manager:
- Protect the password manager itself with a strong password.
- Enable MFA on the password manager where available.
- Don't allow other people to access your password vault.
SuperControl doesn't require you to use a particular password manager.
Keep Multi-Factor Authentication (MFA) enabled
MFA provides an additional layer of security when signing in.
Even if someone obtains your password, the password alone isn't enough to complete the sign-in process when MFA verification is required.
We recommend that every SuperControl user keeps MFA enabled.
For more information, see What Is Multi-Factor Authentication (MFA)?
Give every user their own login
Every person accessing SuperControl should have their own individual user account.
Each user should have:
- Their own SuperControl login
- A valid email address they can access
- Their own password
- Their own MFA method
Avoid using a shared or "universal" login between team members.
Why do individual logins matter?
Individual user accounts:
- Improve account security
- Make access easier to manage
- Allow MFA to be associated with the correct person
- Help identify which user has made changes
- Help SuperControl Support investigate issues
- Allow an individual's access to be removed when they leave your business
This builds on the security guidance you've already been communicating through your Coffee Club material around individual user accounts, MFA and secure access.
Never share your security information
Keep your login and verification information private.
Never share:
- Your password
- An SMS verification code
- An authenticator-app verification code
If someone asks you for this information unexpectedly, don't provide it.
Be alert to phishing and fake login pages
Phishing attempts are designed to persuade you to reveal login or security information.
Be cautious of unexpected emails, messages or websites asking you to:
- Sign in urgently
- Reset a password you didn't request
- Provide your login details
- Provide an MFA verification code
- Click an unfamiliar login link
How can I check whether a sign-in message is genuine?
Before following a login link, ask yourself:
- Was I expecting this message?
- Does the sender look genuine?
- Does the website address look correct?
- Is it asking me for information SuperControl wouldn't normally request?
- Is it creating unusual urgency?
If you're unsure whether something claiming to be from SuperControl is genuine, contact SuperControl Support before following the instructions.
Review user access regularly
As your team changes, your SuperControl users should change with it.
Periodically review your Login Users and check that:
- Everyone with access still requires it
- Former employees have been disabled
- Users have only the access they need
- Login email addresses are current and accessible
- Each user has their own login
- MFA remains enabled
Avoid leaving unused or unnecessary login users active.
What should I do if I think my account has been compromised?
If you believe someone else may know your password or may have accessed your account:
- Reset your password as soon as possible.
- Make sure MFA is enabled.
- Review the users who have access to your SuperControl account.
- Check for any unexpected changes to your account.
- Contact SuperControl Support if you believe unauthorised access may have occurred.
Account security checklist
Before you finish, check that:
- ✓ You use a strong, unique SuperControl password
- ✓ MFA is enabled
- ✓ Every team member has their own login
- ✓ Every login uses a valid, accessible email address
- ✓ User access is reviewed regularly
- ✓ Former users are removed
- ✓ You access SuperControl from a trusted source
- ✓ You know not to share passwords or verification codes
- ✓ Your team knows how to recognise suspicious login requests
Related articles
Understand account security
- What Is Multi-Factor Authentication (MFA)?
Set up MFA
- Set Up Multi-Factor Authentication Using an Authenticator App
- Set Up Multi-Factor Authentication Using SMS
Manage users
- Add a New Login User
- Why Every User Should Have Their Own Login
Need help accessing your account?
- Reset Your Password
- Troubleshooting Login Issues