Turn it on
- Install an authenticator app on your phone, such as one from your password manager.
- Open your account menu, choose Security, and in Two-step verification choose Set up.
- Scan the QR code with the app, then enter the 6-digit code it shows.
- Save your recovery codes somewhere safe. You get 10, and each works once.
Important: Recovery codes are the only way back in if you lose your phone and have no passkey. Store them in a password manager, not in the same place as your password.
Signing in with a code
After your password you are asked for the 6-digit code. If your phone is not at hand, choose Use a recovery code instead. Codes cannot be reused.
Note: After 10 wrong codes in a row, two-step sign-in is locked for an hour and you get an email about it. A correct code resets the count. Turning on two-step verification also signs out your other sessions.
New recovery codes and turning it off
- New recovery codes replace the old set at once. You confirm with a code from your app.
- Turn off removes the second step. It is not available while your organization requires two-step verification.
Require it for your team
Owners and admins can require two-step verification for every member in Settings, Security. Turn it on for your own account first. After that, members without it are asked to set it up before they can continue working.
Tip: Requiring it is the single most useful thing you can do to protect your investors' data.
Investors
Investors can also turn on two-step verification from their portal profile. It is optional there.