Premises — property operations platform
SupportStart free
Security, privacy and your data5 min read

Two-factor authentication: setting it up and what recovery codes are for

A password is something you know. A second factor is something you have. An attacker who gets the first still cannot sign in without the second, and that one change removes most of the ways an account actually gets taken over.

By the end of this pageYou will have two-factor on your account, recovery codes saved somewhere safe, and know how to recover if the phone is lost.
On this pageWhy an app and not SMSIf you lose the phoneTenants
Turning on two-factorWalkthrough
My account › SecurityTwo-factor authenticationOff. Anyone with your password can sign in.Turn onStep 1 of 3Scan with an authenticator appGoogle Authenticator, Authy,1Password, Microsoft Authenticator…Or type the key: JBSW Y3DP EHPK 3PXPEnter the 6-digit code from the appStep 2 of 3Save your recovery codesEach works once, without the phone. Print them or put them in a password manager.k7f2-p9qam3xd-42trz8wn-c1veb5yh-l0ksr9jt-e6mud4cq-n7pah2lv-x3wbt6ga-s8fzPrintI have saved themStep 3 of 3Two-factor is onFrom now on: password, then a code from your phone.Recovery codes used: 0 of 8Require it for everyone? Settings › Security › Require two-factor
  1. Open My account › Security and press Turn on.
  2. Scan the code with an authenticator app — Google Authenticator, Authy, Microsoft Authenticator, 1Password, or any other that supports time-based codes. If you cannot scan, type the key shown under the code.
  3. Enter the six digits the app displays. This proves the pairing worked before anything is enforced.
  4. Save the recovery codes. Eight codes, each usable once, each a way in without the phone. Print them, or store them in a password manager. Do not screenshot them to the phone you just paired — losing that phone would then lose both factors.
  5. Require it for everyone, if you are an admin: Settings › Security › Require two-factor. Staff without it set up will be asked to do so at next sign-in and cannot continue until they have.

Why an app and not SMS

Codes by text message can be delayed, intercepted by SIM-swap fraud, or simply not arrive in a basement. An authenticator app generates the code on the phone itself, with no signal needed, and the secret never leaves the device.

If you lose the phone

Sign in with your password and one recovery code instead of the app code. Go straight to My account › Security, turn two-factor off and on again to pair the new phone, and the old pairing stops working. If the recovery codes are lost too, an admin of your workspace can reset two-factor for your account from People › Staff; if you are the only admin, contact support and be ready to prove who you are.

Tenants

The portal offers two-factor to tenants the same way. You can require it in Settings › Security; most landlords leave it optional, since a tenant's portal can read their own invoices and nothing else.

Your account first. Before you invite anyone, lock the account that can see everything. Your first day puts it fourth for a reason.

Related

Security · 3 minLockout and rate limitsRead the article →Security · 4 minSecurity on your sideRead the article →Security · 4 minThe audit logRead the article →
←  How your data is keptLockout and rate limits  →

Describes the platform as it is today. Something out of date? Tell us. · help 0.12.3