Account security

Two-factor sign-in

• A second factor is a confirmed authenticator app or at least one passkey. Recovery codes are a fallback for the authenticator app, not a factor of their own.
• Password sign-in asks for a code only when you have an authenticator app. If your only factor is a passkey, sign in with the passkey to be treated as having used two factors.
• Regenerating recovery codes needs a recent password check, voids the old codes and emails you, so a stolen session cannot do it quietly.
• If you lose the authenticator app and every code, support can reset your two-factor after checking it is you, with a second member of staff approving. It removes the app, codes and passkeys and signs you out everywhere.

Organisations that require it

An organisation owner can require two-factor for every member, with a grace period (the owner chooses 0 to 90 days; the default is 14). Members without a factor get an email at once and reminders as the end nears. After the grace period a member without a factor is sent to this page and cannot use the organisation until they enrol. API tokens made by that member stop working too. While a rule needs it, you cannot remove your last factor. The owner needs a factor of their own before they can switch the rule on. See organisations.

Change your sign-in email

1. Ask on the Account page. It needs a signed-in browser session (not an API token) and a recent password check.
2. A link goes to the new address and is valid for 24 hours, once. Opening it proves you own it.
3. The old address is told at once, with a link that cancels the request if it was not you.
4. Only when the new address confirms does the change happen. Every session is then signed out, unused email links stop working, and the old address is told it happened.

Passkeys, your authenticator app and API tokens stay. You can ask at most five times an hour, and a newer request cancels an older one. The answer is the same whether or not the new address already has an account. Once a change is confirmed there is no undo link; you would change it back the same way.

Sign-in alerts

We email you when a sign-in comes from a browser we have not seen, or from a known browser on a new network. A network here means the first part of the IP address, not a place: we use no location database. Your first sign-in sets the baseline and sends nothing. The email has a "this wasn't me" link that signs every session out, forgets that browser and network and sends you a password reset link. It leaves API tokens, passkeys and your authenticator app alone, so review those yourself.

To do this we keep, for each browser, a hash of a random cookie, its browser string and the first IP address it signed in from, and for each alert the full IP address and browser string. We keep up to 25 browsers and 50 networks per person and forget ones not seen for a year. See the privacy notice.

If our staff lock an account

Staff can lock an account for security reasons. A lock signs you out everywhere and stops your API tokens. It does not stop your servers or your billing. You are emailed. Contact support to have it looked at.

Not built

• Automatic temporary lock after repeated failed sign-ins (rate limits apply instead).
• An undo link after an email change is confirmed.