Security

You need an authenticator app on your phone, such as Google Authenticator, 1Password or Authy.

1. Open Account → Security.
2. In Two-factor authentication, press Turn on. The Turn on two-factor authentication dialog opens.
3. Scan the QR code with your app. If you cannot scan it, type into the app the key shown below the QR code.
4. Enter the six-digit code the app shows in Code from the app and press Confirm and turn on.
5. The Save your recovery codes dialog shows your 10 recovery codes. Press Copy or Download and keep them somewhere safe, outside your email.
6. Press I have saved them.

The recovery codes are not shown again. The dialog does not close until you press I have saved them.

Nothing changes until step 4: if you close the dialog before confirming, two-factor authentication stays off.

1. Enter your email and the code you receive by email, as always.
2. The console then asks for the six-digit code from your authenticator app. Enter it.

Without your phone, press I do not have my phone: use a recovery code and enter one of your recovery codes. That code stops working after that sign-in, and you receive an email saying how many you have left.

Do it when you have few left, or if you think someone else has seen them.

1. In Two-factor authentication, press Generate new codes.
2. In Code from the app, or a recovery code, enter a code from your app or a recovery code you still have.
3. Press Generate new codes to confirm.
4. Save the 10 new codes and press I have saved them.

The previous codes stop working at that moment, including the ones you had not used.

1. In Two-factor authentication, press Turn off.
2. In Code from the app, or a recovery code, enter a code from your app or a recovery code.
3. Press Turn off to confirm.

From then on you sign in with the email code only. Your recovery codes stop working, and you receive an email confirming the change. If you turn it on again later, you scan a new QR code and get new recovery codes.

• One device. In Trusted devices, press Revoke on its row. The device you are using has no button.
• All of them. Press Manage devices. The Revoke all trusted devices dialog opens; press Revoke all. This removes every device from the list, including the one you are using.

A device you do not remove leaves the list on its own after 30 days.

1. In Active sessions, press Sign out everywhere.
2. Read the confirmation and press Sign out everywhere.

Signing out on every device also removes all your trusted devices: the next sign-in on each of them will ask for the emailed code.

All your sessions end, including this one, and you are taken to the sign-in page. It only affects your sessions, not those of the other members.

1. Go to the last block, Export the account data.
2. Press Download ZIP. The browser downloads a ZIP file with the name of the account and the date.

The file contains:

• The account and the list of its Workspaces.
• For each Workspace, its client contacts and the reports already generated for it.
• For each domain, its analyses, its continuous stabilization history, scores, measurements, alerts with their evidence, its timeline and its evidence reports.
• A manifest listing what the file contains and anything that was left out.

Data is always included. If the reports together are too large, the ones that do not fit are left out and the manifest lists them.

The code from the app changes every 30 seconds. Check that it is the one showing right now, and that you are looking at the entry for this console in your app, then try again. If it keeps failing, check that the date and time of your phone are set automatically.

A code from the app is accepted only once. If you have just used it, for example to turn on two-factor authentication, wait for the app to show the next one. A recovery code also works only once.

When you sign in, you have 5 attempts for the second factor; the message tells you how many are left. After the fifth wrong one, the code sent by email is cancelled too. Ask for a new email code and start again.

At sign-in, press I do not have my phone: use a recovery code and enter one of your recovery codes. Once inside, you can turn two-factor authentication off with another recovery code, and turn it on again with your new phone.

Ask an Owner of your account to reset your two-factor authentication. They do it from Team, with the Reset 2-factor button in your entry of the member list. See Team. You receive an email saying who did it, and from then on you sign in with the email code only.

An Owner cannot reset their own. If you are the only Owner of the account, the console gives you no way to recover access by yourself: write to us from your account email.

The warning appears with 3 unused codes or fewer. Press Generate new codes to get 10 new ones before you run out. See Security.

If Recent sign-ins shows a successful sign-in that was not you, press Sign out everywhere to end every session, and turn on two-factor authentication if it is off. A failed attempt is one that did not get in.

• Your role does not include managing the account. Instead of the file, the browser shows an error message. Ask the account Owner to download it or to change your role.
• You downloaded it several times in a row. The export can be requested 3 times per hour. Wait and try again.

The message shows a code in parentheses. Try again in a minute. If the block Two-factor authentication did not load, press Retry. If it keeps happening, send us that code with your account email.