Sign-in and security

You sign in with your email and password, and a code from an authenticator app if you turn that on. You manage your own password, two-factor sign-in and sessions in My security.

Sign in

What it's for: one account works for every organisation you belong to. You open in the organisation you used last.

Before you start: your email must be verified. If you were invited, accept the invite from your email first.

1. Open the sign-in page.
2. Enter your Email and Password, and select Sign in.
3. If you use two-factor, enter the 6-digit code and select Verify.

What can go wrong:

Turn on two-factor sign-in

What it's for: someone with your password still can't sign in without a code from your phone.

Before you start: install an authenticator app, such as Google Authenticator, 1Password or Authy. Have somewhere safe ready for your recovery codes.

1. Go to My security.
2. Under Two-factor authentication, select Set up two-factor.
3. Scan the QR code with your app, or enter the key by hand.
4. Type the 6-digit code the app shows and select Turn on two-factor.
5. Save your recovery codes, then select Done.

What happens next: the card shows On. You need a code at every sign-in. Your app shows a new code every 30 seconds, and each code works once.

What can go wrong: "That code is incorrect. Check your device's clock and try again." means your phone's time is probably off. Set it to automatic.

To turn it off, select Turn off, enter your Password and an Authenticator or recovery code, and select Turn off two-factor. If your organisation requires two-factor, you'll have to set it up again.

Recovery codes

• You get 10 codes when you turn on two-factor. They're shown only once.
• Each code signs you in once. My security shows how many you have left.
• To use one, sign in as usual, select Use a recovery code on the code screen, and enter it.
• For a new set, turn two-factor off and set it up again. The old codes then stop working.

Keep them away from your phone. Without your app or a recovery code you can't sign in, and resetting your password doesn't turn off two-factor.

Require two-factor for everyone

What it's for: making sure no member of your organisation signs in with a password alone.

Before you start: you need to be an Owner or Admin. The rule includes you, so set up your own first. Tell your team.

1. Go to Settings → General.
2. Under Security, tick Require two-factor authentication for every member.
3. Select Save changes.

What happens next: members without two-factor see Set up two-factor authentication at their next sign-in, and sign in again with their new code. A member already signed in is signed out when their session next renews.

What can go wrong:

• The setup screen is valid for 10 minutes. After that, sign in again to restart it.
• If you belong to several organisations, switching to one that requires it can show "This organisation requires two-factor authentication. Set it up in My security first."

Change or reset your password

A password needs 12 to 128 characters. There are no rules about symbols or capitals. Common or leaked passwords are refused.

If you know your password:

1. Go to My security.
2. Enter your Current password and New password.
3. Select Change password.

If you forgot it:

1. On the sign-in page, select Forgot your password?
2. Enter your Email and select Send reset link.
3. Open the link in the email. It expires in 1 hour.
4. Enter your New password, then Confirm new password, and select Change password.

What happens next: either way, you're signed out everywhere. Sign in with the new password.

What can go wrong:

• No email: check spam. You can ask for 3 links an hour. For safety, the page says the same thing whether or not the account exists.
• "This link is invalid or has expired": the link was used or is over an hour old, or you asked for a newer one. A new request cancels older links. Ask again.

Sessions

• You stay signed in while you use i-Connect. A session ends after 14 days without use, and after 30 days at most.
• Lost a device or used a shared computer? Select Sign out everywhere in My security. This ends your sessions in every browser, including this one.
• Changing or resetting your password does the same.
• A role change or removal takes effect straight away, even for someone who is signed in.

What support access means

If our support team needs to look inside your organisation, a staff member starts a support session. These rules are enforced by the server:

• Reason required: staff can't start without a written reason of at least 10 characters.
• 60 minutes: a session ends after 60 minutes and can't be renewed. Another session needs its own reason and is logged again.
• Read-only by default: staff can read what an Owner can read, and changes are refused. Only senior staff can open a session that can make changes.
• Limits in every session: staff can't launch or approve broadcasts, export contacts or reports, reveal full phone numbers or change billing, even in a session that can make changes.
• Shown in your audit log: Owners and Admins can see it in Settings → Audit log, marked Platform staff.

To find these, enter the action in Filter by action and select Apply. Entries stay for as long as your plan keeps the audit log.