Skip to main content
From Security (in the side menu) you can protect your account and see which devices have it open.

​
Two-step verification (2FA)

With two-step verification, besides your password the system asks for a 6-digit code generated by an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Authy, 1Password, etc.).
It is optional: each user decides whether to turn it on.

​
Turn it on

1

Go to Security

Open Security from the side menu and type your current password in the activation box.
2

Scan the QR code

Scan the QR with your authenticator app. If you cannot scan it, type the key shown below the QR by hand.
3

Confirm with a code

Type the 6-digit code shown by the app and click Activate.
4

Save your recovery codes

The system shows 10 recovery codes. They are shown only once: copy them and keep them somewhere safe.
Turning it on closes your other open sessions.

​
Signing in with 2FA

After typing your email and password, the system asks for the 6-digit code from your app. If you do not have your phone, use a recovery code.
  • Each app code works only once.
  • After several wrong codes in a row, the sign-in attempt is cancelled and you must type your password again.
  • Each recovery code works only once. When they run out, generate new ones from Security.

​
Generate new recovery codes

In Security → Regenerate codes type your password and a current code from the app. The previous codes stop working.

​
Turn it off

In Security → Disable type your password and a current code.

​
I lost my phone and my codes

Ask an administrator of your company to reset your 2FA (in Users, the two-step verification icon). Your sessions are closed and you can set it up again when you sign in.

​
Active sessions

In Security → Active sessions you see each device that is signed in: browser or app, system, IP, last use and start date. The session you are looking from is marked This session.
  • Close — ends that session; the device will have to sign in again.
  • Close all other sessions — leaves only the current one open. Use it if you lost a device or suspect someone else got in.
Sessions started before the version that added this list appear as Unknown device with no IP.

​
When your sessions are closed automatically

The system closes all of a user’s sessions when:

​
How long a session lasts

  • Browser — the session stays open even if you close the tab and is renewed automatically while you use it. After 48 hours without activity it is closed, and in any case it lasts at most 7 days from when you signed in; after that you must sign in again (and type the 2FA code if you use it).
  • Mobile app — it renews automatically in the background. It is closed after 30 days without opening the app and lasts at most 90 days; after that you must sign in again.
If your session expires, the system lets you know and takes you to the sign-in screen.
Each time it renews, the system replaces the session’s credentials with new ones. If someone tried to reuse credentials that were already replaced, the whole session is closed for security.

​
Disabled accounts and activation

  • A disabled account cannot sign in, even with the correct password.
  • When you sign up, the account stays disabled until the email is confirmed with an activation code sent by email. The code expires after 30 minutes, works once and is voided after 5 wrong attempts.