Help › Team & security
Two-factor, sessions and the audit log
Keeping the account safe, and finding out what changed.
Two-factor authentication
Required for every account. On your first login you are asked to set it up with an authenticator app — Google Authenticator, Authy, 1Password, any of them.
You are also given recovery codes. Save them somewhere that is not your phone. They are the way back in if you lose the device, and they are shown exactly once.
Active sessions
Settings → Security lists everywhere you are signed in, with the device and the last time it was used. Anything you do not recognise, sign out — and change your password.
Forgotten passwords
Forgot your password? on the login page. The link works once and lasts an hour, and using it signs that account out of every device, which is what you want if the reason you are resetting is that you think somebody else got in.
The audit log
Audit Log in the sidebar records who changed what, and when. Worth knowing it exists before you need it — the day a contact's details look wrong is a bad day to discover you have no history.