Security
Official guide · English · Version 9c253d0cf11816df
The Security tab provides tools to protect your account. It is organized into five sections: password management, two-factor authentication (2FA), login history, active sessions, and trusted devices.
Automatic Sign-Out
The tenant dashboard signs out after 15 minutes without activity. Typing, clicking, moving the pointer, touching, or scrolling in any dashboard tab in the same browser keeps the session active. Background updates do not count as activity. Reloading the page does not restart the inactivity period; returning after a long absence or computer sleep requires signing in again. Save your work before leaving the panel.
While you are active, the dashboard renews your login automatically. Temporary network failures do not by themselves clear your login. Administrator Login as tenant sessions also have a maximum duration of two hours, after which the administrator must open a new session.
Change Password
The Change Password card lets you update your account password.
Fields
| Field | Description |
|---|---|
| Current Password | Your existing password. Required to verify your identity before allowing the change. |
| New Password | The password you want to switch to. Must be at least 8 characters long. |
| Confirm New Password | Re-enter the new password. Must match the New Password field exactly. |
How to Change Your Password
- Navigate to Settings > Security.
- Enter your Current Password.
- Enter your desired New Password (minimum 8 characters).
- Re-enter the new password in the Confirm New Password field.
- Click the Change Password button.
- If successful, a green success banner will appear confirming the change. All three fields will be cleared automatically.
Info: You can toggle the visibility of all password fields by clicking the eye icon on the current password field. This toggles between hidden (dots) and visible (plain text) for all three fields simultaneously.
Common Errors
| Error | Cause |
|---|---|
| Passwords do not match | The new password and confirmation do not match. |
| Password too short | The new password is fewer than 8 characters. |
| Current password incorrect | The current password you entered does not match your account's existing password. |
Two-Factor Authentication (2FA)
Two-factor authentication adds an extra layer of security to your account. Even if someone obtains your password, they will need a second verification code to log in. The platform supports two 2FA methods that can be enabled independently or together.
Available Methods
| Method | Description |
|---|---|
| Authenticator App (TOTP) | Uses an app like Google Authenticator, Authy, or 1Password to generate time-based one-time codes. This is the most secure method. |
| Sends a verification code to your registered email address each time you log in. Convenient but depends on email access. |
Setting Up Authenticator App (TOTP)
- In the Two-Factor Authentication card, find the Authenticator App row.
- Click the Enable button.
- A QR code will appear on screen. Open your authenticator app (Google Authenticator, Authy, etc.) and scan the QR code.
- If you cannot scan the QR code, click to reveal the Manual Entry Key and type it into your authenticator app manually.
- Enter the 6-digit code shown in your authenticator app into the verification field.
- Click Verify and Enable.
- The system will display a set of backup codes. These are one-time-use codes you can use to log in if you lose access to your authenticator app.
Warning: Save your backup codes in a secure location immediately. They are only shown once. If you lose your authenticator device and do not have backup codes, you may be locked out of your account.
Setting Up Email 2FA
- In the Two-Factor Authentication card, find the Email row.
- Click the Enable button.
- Email 2FA will be activated immediately using your registered email address.
- If this is the first 2FA method you are enabling, the system will display backup codes. Save them securely.
Disabling a 2FA Method
- Locate the method you want to disable (Authenticator App or Email). It will show a green "Enabled" label.
- Click the Disable button next to it.
- A confirmation panel will appear asking for your account password.
- Enter your password and click the Disable confirmation button.
- The method will be removed. If you have another 2FA method still active, it will continue to protect your account.
Backup Codes
Backup codes are generated the first time you enable any 2FA method. They provide emergency access if you lose your primary 2FA device.
| Detail | Description |
|---|---|
| Purpose | One-time-use codes to log in when you cannot access your authenticator app or email |
| Quantity | Multiple codes are generated (displayed in a two-column grid) |
| Remaining count | The card shows how many unused backup codes you have left |
| Regenerate | Click the Regenerate button to create a new set of codes. You will need to enter your password. Regenerating invalidates all previous backup codes. |
How to Regenerate Backup Codes
- In the Two-Factor Authentication card, find the Backup Codes section at the bottom (only visible when at least one 2FA method is enabled).
- Note the count of remaining backup codes.
- Click the Regenerate button.
- Enter your account password when prompted.
- A new set of backup codes will be displayed. Save them immediately -- the old codes are now invalid.
Login History
The Login History card shows the five most recent login attempts to your account, including both successful and failed attempts.
Information Displayed
Each login entry shows:
| Field | Description |
|---|---|
| Browser and OS | The browser name and operating system used (e.g., "Chrome on Windows"). |
| Device type | An icon indicating whether the login was from a desktop/laptop or a mobile device. |
| IP Address | The IP address the login came from. |
| Location | Geographic location based on the IP address, if available. |
| Status | Successful logins appear on a neutral background. Failed logins are highlighted with a red background and a "Failed" badge. |
| Date and Time | When the login attempt occurred. |
Info: Regularly reviewing your login history helps you detect unauthorized access. If you see a login from an unfamiliar location or device, change your password immediately and consider enabling two-factor authentication.
Active Sessions
The Active Sessions card shows all devices and browsers currently logged into your account. This section spans the full width of the settings area for better readability.
Session Information
Each session entry shows:
| Field | Description |
|---|---|
| Browser and OS | The browser and operating system of the session. |
| Device type | Desktop/laptop or mobile device icon. |
| IP Address | The IP address of the session. |
| Last Active | When the session was last used. |
| Current Session Badge | Your current session is highlighted with a blue background and a "This Device" badge. |
Revoking a Single Session
- In the Active Sessions card, find the session you want to end.
- Click the Revoke button (log-out icon) on that session's row.
- Confirm the action when prompted.
- The session will be terminated and the user on that device will be logged out.
Info: You cannot revoke your current session from this panel. The revoke button is only shown for other sessions.
Revoking All Other Sessions
If you suspect unauthorized access, you can log out all other devices at once:
- Below the session list, click the Log Out All Other Devices button.
- Confirm the action when prompted.
- All sessions except your current one will be terminated immediately.
Trusted Devices
The Trusted Devices card manages devices that have been marked as "trusted" during 2FA login. When you trust a device, you will not be asked for a 2FA code on future logins from that device until the trust expires. This section also spans the full width of the settings area.
Trusted Device Information
Each trusted device entry shows:
| Field | Description |
|---|---|
| Browser and OS | The browser and operating system of the trusted device. |
| IP Address | The IP address when the device was trusted. |
| Expires | The date when the trust will expire and 2FA will be required again. |
Removing a Single Trusted Device
- Find the device in the list.
- Click the Remove button (X icon) on that row.
- The device will be removed and 2FA will be required on the next login from that device.
Removing All Trusted Devices
- Click the Remove All Trusted Devices button below the device list.
- Confirm the action when prompted.
- All trusted devices will be removed. Every device will need to complete 2FA on the next login.
Info: The Trusted Devices section only appears when you have two-factor authentication enabled. If you have not set up any 2FA method, the list will be empty.