Security

Everything on this page is yours, not the organization's: you manage it for your own account, whatever your role, and it affects nobody else. The screen is in your user menu, at the bottom of the sidebar: My account → Security.

Two-step verification

Your password is a single thing someone can come to know: it leaks from another service where you reused it, it gets guessed, it gets read over your shoulder. Two-step verification adds something you also have to hold: a six-digit code that changes every thirty seconds.

With it on, signing in becomes two steps — password and code — and whoever gets only your password gets nowhere.

We don't send codes by email, and that's deliberate. Your inbox is also where password resets go: a code sent there wouldn't be a second factor, it would be the first one twice over. Anyone who got into your email would hold both halves.

Turning it on

1. Confirm your password. We ask even though you're already signed in: turning on a second factor is as sensitive as changing your password, and the session alone isn't enough if someone sits down at your unlocked machine.
2. Add it to your app, by scanning the QR code or copying the key as text. Both are the same thing; the text key is there for laptops without a usable camera, and for pasting into a password manager.
3. Enter a code. This step is not a formality: until a valid code arrives, verification is not on. It proves the key was stored correctly before you need it to sign in, not after.
4. Save your backup codes. Ten single-use codes, shown once.

Backup codes

They are the way in when you don't have your phone: you lose it, the battery dies, you switch devices. Each one works once and takes the place of the app's code.

• Keep them where you can reach them without your phone. A password manager, printed in a drawer. Keeping them only on the same phone that generates the codes is no use at all.
• We cannot show them again. They exist in the clear only that once; afterwards we keep only a fingerprint of them. If you lose them, you generate new ones.
• We will never ask you for them, not by email and not through support. Treat them like your password.

Signing in with it on

After your password we ask for the six-digit code, on the same screen. If your app isn't to hand, the "I can't get to my app" link lets you use a backup code instead.

Things worth knowing before they happen to you:

• The code screen expires after 10 minutes. If you go looking for your phone and take a while, it isn't a fault: start signing in again.
• If you get the code wrong several times running, one of two things happens. Usually the screen sends you back to your password; there's no waiting there, you carry straight on. If you keep at it, the account locks for a while (about fifteen minutes).
• If you retry very fast a "too many requests" notice may stop you first. Leave a few seconds between attempts.
• A correct code that gets rejected is almost always the clock. Codes are worked out from your device's time: a few minutes of drift invalidates all of them. Check it before giving up on the app.

The same applies when you connect an AI assistant: the window that opens in your browser is this very sign-in, so it will ask for the code too. See Connect your AI assistant.

Generating new backup codes

From the same screen, with your password. The previous ten stop working right then, so if you had them written down anywhere, throw them away.

Do it once you've used several, when you're not sure where they ended up, or when you suspect somebody may have seen them.

Turning it off

From there too, confirming with your password. From that moment your password is once again the only thing protecting your account, and your backup codes stop working. To have it on again you go through the whole setup, with a new key and new codes.

If you get your password wrong several times

After five failed attempts in a row, the account locks for thirty minutes. During that time not even the correct password gets in, and the message tells you how long is left.

You don't have to wait: resetting your password lifts the lock immediately. The "Forgot your password?" link is on the sign-in screen itself.

You may also see "too many requests from this connection", which is a different thing: it lasts seconds and has nothing to do with your password. It shows up when several attempts are made from your network in quick succession, and the allowance is shared with everyone who reaches the internet through the same line — an office, a VPN — so it can catch you without you having done anything odd.

Leaked passwords

When you choose a password — signing up, or resetting it — we check that it doesn't appear in the known public breaches. If it does, we reject it and you'll have to pick another.

It doesn't mean your account is compromised: it means that password already circulates in lists anyone can download, so trying it is the first thing an attacker would do. The check never sends your password anywhere; it works in a way that nobody, us included, gets to see it.

Updated on Aug 24, 2026