Account security

Two settings under Company deal with getting into the account: one for everybody, one for you.

Two-factor authentication

Settings → Company → Miscellaneous settings holds a single switch.

Settings → Company → Miscellaneous settings

Turn Enable Two Factor Authentication for Account Login on and press Update.

From then on, signing in takes two steps. After the password is accepted, a one-time code is sent to the registered email address for that login, and the account only opens once the code is entered. The code is short-lived, and the sign-in screen offers to resend it.

The switch is account-wide. It applies to everyone who signs in, not only to the person who turned it on.

Three wrong passwords lock the account — but only while two-factor is on. With Enable Two Factor Authentication for Account Login switched on, three consecutive wrong passwords block the login.

A blocked account is unblocked by another admin, and only that way. They sign in with their own account, open the Users section, find the blocked user and unblock them. Forgot password does not do it — resetting the password leaves the block in place — and the blocked person cannot do it for themselves. Which is a good reason for an account never to have just one admin. With the switch off, wrong attempts do not block the account.

One session at a time

A login belongs to one device at a time. Signing in somewhere new signs that same login out everywhere else: open the account on a phone and the laptop session ends, and the other way round.

This catches admins most often, because they plan on the desktop and carry the app as well — the two cannot both be open on one login. The mobile app is no different on its own: one login cannot be in use on two phones at once.

So two people cannot work under one username and password, and one person cannot keep a laptop and a phone signed in together. Give everybody their own user — see adding a user.

Changing your password

Settings → Company → Change Password changes the password of the login you are signed in as — your own. It is not where you reset somebody else’s; that happens on their user record.

Settings → Company → Change Password

Fill in Current Password, then the new one twice, and press Save. All three are required — knowing the current password is what proves the person at the keyboard is you.