Account security, password and two-factor authentication
Change your panel password, turn on two-factor authentication (2FA), manage recovery codes, learn what to do when you change phones and how to sign out everywhere.
Your panel account gives access to your business's guest data and Law 5651 records. This page explains what to do to protect it. The screens are the same for all three roles; only their place differs:
| Role | Security section |
|---|---|
| Customer | Profile → Account security |
| Reseller | Profile → Account security |
| Administrator | the My account page |
Who must use two-factor authentication
| Role | 2FA |
|---|---|
| Administrator, reseller | Required. The setup screen opens at first login; it cannot be turned off. |
| Customer and team members | Required by default. Existing accounts get a short transition period (the panel shows the deadline); after it, sign-in goes to the setup screen. The platform administrator can exempt a business with a reason; 2FA that is already set up is still asked for. |
Any authenticator app that generates codes works: Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden. Codes are 6 digits and change every 30 seconds.
Turn on 2FA (customer)
- Press Enable on the Two-step verification (2FA) row.
- Scan the QR code with your authenticator app.
- Enter the 6-digit code from the app and your password in Current password.
- The Your recovery codes screen shows 10 recovery codes. They are shown only once; save them in your password manager.
From then on, the Two-step verification screen follows the password at every login. If your phone is not with you, use a recovery code with Use a recovery code; each code works once.
Attempt limit
After 5 wrong codes or passwords within 15 minutes, 2FA actions are locked for a while. Codes depend on the phone's clock; if you keep seeing "wrong code", set the phone's time to automatic.
Recovery codes
When Recovery codes left gets low, create 10 new codes with Regenerate recovery codes (your password and a current code are required). Creating new codes invalidates all old ones.
When you change phones
- Customer: while you still have the old phone, turn 2FA off with Turn off and turn it on again on the new phone.
- Administrator and reseller: turning 2FA off (password + code required) signs you out everywhere; at the next login you set it up with the new phone.
- Phone and recovery codes both lost: ask the platform administrator to reset your 2FA. The administrator verifies your identity outside the panel (registered phone, in person); the reset signs you out everywhere and is written to the audit log.
Change your password
In the customer panel use Change Password on the Profile page; resellers press Change Password on Profile, administrators on the My account page. The password must be at least 6 characters; use a long, unique one. If an administrator or reseller gave you a temporary password, you are asked to set a new one at first login.
Changing the password signs out your sessions on other devices immediately.
Sessions
- A login is valid for 30 days; use does not extend it, and when it ends you sign in again.
- Sign out of all sessions signs you out of every browser where the account is open, including this one. Use it if you left a session open on a shared computer or suspect your password was shared, then change your password.
Administrator: actions on behalf of a user
On a customer or reseller detail page the administrator can use Sign out everywhere and Reset 2FA in the Sessions and 2FA card. Both are written to the audit log. Administrators cannot reset their own 2FA with this card.