MFA in HR SaaS: why 62% of French vendors still don't offer it

The reality

Out of the last 50 French HR SaaS products we audited, 31 offered no form of MFA to their users. No TOTP, no WebAuthn, not even SMS. Just an email and password.

For applications that store payslips, employment contracts, and social security numbers, that's a problem.

Why MFA is lagging

"Our clients don't ask for it"

The most common argument. And it's changing. With NIS2 and increasing enterprise requirements, MFA is becoming a prerequisite in security questionnaires. Not offering it means losing contracts.

"It's complicated to implement"

With Supabase Auth, Firebase Auth, or NextAuth, TOTP MFA can be set up in a few hours. WebAuthn (security keys, Face ID, Touch ID) requires a bit more work but remains accessible.

"It degrades the user experience"

A valid argument in 2020. In 2026, everyone uses an authenticator on their phone. And passkeys make authentication even smoother than a traditional password.

What we find in audits

When MFA isn't in place, we systematically find:

All of these problems are mitigated by MFA. Even if an attacker gets the password, they need the second factor.

The 3-step action plan

Step 1: offer optional TOTP

Start by offering TOTP authentication (Google Authenticator, Authy) as an option. Encourage it without forcing it. Measure adoption.

Step 2: make MFA mandatory for admins

Admin accounts have access to all data. They must be protected first. Make MFA mandatory for admin and super-admin roles.

Step 3: WebAuthn for everyone

Passkeys are the future. They're more secure than TOTP (phishing-resistant) and simpler for users. Start integrating them now.

CleanIssue recommendation

During our First Review, authentication mechanisms are one of the first points analyzed. If your HR SaaS doesn't offer MFA, it's a strong signal to your clients that your security posture needs improvement.