Do We Really Need MFA in Nursery and Preschool Software?

What Multi-Factor Authentication is, why it matters in early years settings, and how it works without disrupting daily practice

As more early years providers transition to digital systems for safeguarding and record-keeping, questions often arise regarding data security, particularly about Multi-Factor Authentication (MFA).

If you're a director, owner, operational lead or setting manager, you may have asked or been asked:

Do we really need MFA? Does it suit how nurseries actually work?

Here's a clear answer. MFA is a key part of protecting sensitive data, and it can be implemented by everyone in a way that not only works with but also enhances the daily realities of nursery life.

What is MFA, and how does it usually work?

Multi-factor authentication adds a second step to logging into a secure system. It combines:

1.    Something you know, like a password

2.    Something you have, like a code sent to your phone or email

Most people are familiar with this from online banking. You enter a password and then receive a code. It makes it much harder for the wrong person to gain access, even if they have your password.

But that model doesn't work practically in early years settings, where staff working directly with children cannot use mobile phones and need to stay focused. That's why we've adapted it to work for the sector.

Is MFA required under the 2025 Safeguarding Reforms or Ofsted?

Not explicitly. The 2025 reforms do not mandate MFA by name, but they raise expectations around:

Secure digital record-keeping

Precise access controls and accountability

Timely logging, reviewing, and acting on concerns

Ofsted is increasingly asking questions like, "Who can access this information?" and "What's the audit trail?" MFA helps demonstrate that your setting is taking those responsibilities seriously.

How MFA works in On the Button

We've designed On the Button to reflect how early years settings actually operate.

Practitioners

Have their own logins to create logs and records

Use the standard two-step login process

Do not need mobile phones or verification codes

Once logs are submitted, they are no longer visible to the practitioner

Senior staff such as DSLs, room leads and managers

Have broader access to safeguarding data

Use the same two-step login process as practitioners

Email addresses are verified as part of the account setup

May receive alerts when something needs attention

Security features for senior staff

Senior staff can reset team passwords regularly to add extra security

Email addresses are verified as standard during setup

All users log in using a two-step process: first, they enter the two parts of the setting's details, and then they enter their username and password. No additional codes or devices are required. Our approach ensures that security and practicalities are equally considered.  Mobile phone use should be restricted in early years settings to maintain the safeguarding of the children.

MFA is one part of a bigger safeguarding ecosystem

It's important to note that MFA is not the only security feature we use. It is one layer of protection working alongside others, including:

Role-based access controls, so staff only see what they need to

Encrypted data storage

Time-stamped activity tracking

Automatic session timeouts after periods of inactivity

Customisable permissions

Digital audit trails for review and escalation

Together, these features create a comprehensive safeguarding ecosystem that provides a high level of protection for children, supports staff, and gives leaders the oversight they need to ensure the safety and well-being of everyone in the setting.

Why it matters for owners and managers

If you are responsible for leading one or more settings, you need confidence that:

Sensitive safeguarding data is secure

Roles and responsibilities are clearly defined

Reporting is accurate, accessible and inspection-ready

The system supports your team to act quickly, not slow them down

Crucially, the information being handled is not just operational. It relates to the well-being of individuals, safeguarding concerns for children, and safer recruitment information for staff. These are highly sensitive areas where failure to protect data or respond appropriately can have serious consequences, both for individuals and for the reputation and safety of the setting.

MFA helps meet that standard. It ensures that only authorised staff can access sensitive information and that the system automatically records who accessed it, what action they took, and when they did it.

In short, MFA matters, but it must be fit for purpose.

On the Button utilises MFA to enhance the safeguarding of data while ensuring practicality.  It supports the expectations of the 2025 reforms, aligns with Ofsted's increasing focus on secure systems, and gives leaders the clarity and confidence they need.

Safeguarding begins with the right people having the right access at the right time, with the necessary protections in place.