Secure your account: password, 2FA and sessions

Everything is in Settings → Profile and Settings → Security.

The four delays worth knowing in advance

What you do	The delay
Revoke a session	Up to 5 minutes before it stops answering
Open a password reset link	Immediate: all your other sessions are cut
Lift two-factor authentication without your phone	72 hours

Change your password

Twelve characters minimum, from Settings → Profile. No required capital, no imposed special character: those rules produce short, predictable passwords, where length does the work.

Reset a forgotten password

Ask for a link from the sign-in screen. The form answers the same thing whether the address exists or not, so that it cannot be used to find out who is a customer.

The link you get is single-use and lasts an hour.

Opening that link cuts all your other sessions, immediately. That is what you want when you suspect an intrusion: changing the password also throws out whoever was in.

Three sends per hour per recipient address, plus a limit per IP address.

Turn on two-factor authentication

Open Settings → Security and scan the QR code with the authenticator app of your choice. The code is then asked for at every sign-in. Keep the backup codes the screen shows you.

Your organization can require it. Until you turn it on, you stay signed in and keep reading everything, but creating, changing or deleting anything is refused, with a message that sends you here. Access comes back as soon as you enable it, with no need to sign in again.

Two points:

• The requirement belongs to the organization, not to your account. If you belong to several organizations, it only applies in the one that set it.
• A passkey does not satisfy it. It signs you in on its own, but the rule is about the one-time code today.

You lost your phone and your backup codes

There is a way out, and it takes 72 hours.

1. On the screen asking for your code, choose “lift after a security delay”.
2. Enter your password. That is what proves it is you.
3. Come back three days later and sign in: you can then lift two-factor authentication.

During those three days:

• you get a message containing a link to cancel the request in one click;
• the people responsible for your organizations are notified, without that link. They are informed, they do not decide for you;
• a banner appears in each of your sessions that is still open, with the same cancel button. If you are still signed in somewhere, you do not even need the email.

At the deadline, the lift destroys your authenticator app, your backup codes and your trusted devices, and closes all your sessions. Sign back in with your password alone, then set up two-factor authentication again.

We cannot shorten that delay, and nobody here will offer to. No button exists, for anybody, that speeds a request up. That is what makes a convincing phone call not enough to get into your account. Without the delay, somebody who stole your password would remove your two-factor authentication in a minute.

If you still have a passkey, this path is refused to you. You do not need it: go back to sign-in and choose Sign in with a passkey.

Three requests per day at most. Cancelling and asking again does not bring the deadline closer.

Revoke a session

Settings → Security lists your active sessions and lets you revoke them. A session lasts seven days.

Allow up to five minutes before a revoked session stops answering: the cookie carries a signed copy of its state, and deleting a row in the database does not reach a cookie already sitting in a browser.

If five minutes are five minutes too many, change your password: opening the reset link cuts everything, immediately.

Confirm your email address

A link valid for 24 hours is sent at sign-up. You come in without waiting for it and you name your organization, but until it is opened you cannot create an inbox, invite anyone, or mint an API key, see First message.

Click Send the link again in the banner at the top of the application if the 24 hours have passed.

Click That is not the right address, in the same banner, to correct a typo: the new link goes out immediately. The address also stays editable in Settings → Profile for as long as it is unconfirmed.

An account whose address is never confirmed is deleted after 7 days, along with the organization it created. A reminder goes out the day before. After the deletion, you can sign up again with the same address.

Sign in with Google or your company’s SSO

The Google button only appears if the instance really has Google credentials. SSO sign-in happens by address domain and assumes a configured, verified provider, see SSO.

Delete your account

Settings → Profile, danger zone. Type DELETE, then confirm through the link sent to your address.

Your inboxes, your messages and your API keys are deleted, backups included. This does not delete your organization, see Your organization.