Account security and two-factor authentication

Why it matters

Your workspace holds your clients' work, feedback and approval records. A few minutes spent on account security protects them as well as you. We recommend that every team member turns on two-factor authentication.

Passwords

• Passwords must be at least 10 characters long. A longer passphrase that you do not use anywhere else is best.
• A password manager makes it easy to use a unique password for Ayebridge.
• Team members can also sign in with Email me a sign-in link instead of typing a password. Once two-factor authentication is on, sign-in links are turned off for that account, and you sign in with your password and code instead.

Forgot your password

1. Go to forgot password and enter your email address.
2. Open the reset email and choose a new password. The link works once and expires after one hour.

Resetting your password signs you out of all other sessions. If you did not ask for a reset, ignore the email and your password stays the same.

Two-factor authentication (2FA)

Two-factor authentication adds a second step when you sign in: a six-digit code from an authenticator app on your phone. Even if someone learns your password, they cannot sign in without that code.

Turn on 2FA

1. Open Account (/app/account), from your name in the sidebar.
2. Under Two-factor authentication, select Set up two-factor and confirm your password.
3. Scan the QR code with an authenticator app. Most authenticator apps work, including those built into password managers.
4. Enter the six-digit code from the app to confirm.
5. Save your backup codes somewhere safe, such as your password manager. Each backup code works once.

From then on, Ayebridge asks for a code from your app when you sign in. If you run low on backup codes, select Create new codes.

Lost your phone

1. Sign in with one of your backup codes instead of an app code.
2. Turn two-factor authentication off and set it up again on your new device.

If you have lost both your device and your backup codes, email support@ayebridge.com from your account's email address. We verify your identity before making any change, which can take some time. This is deliberate, to protect your account.

Turn off 2FA

Select Turn off under Two-factor authentication on your account page. We recommend keeping it on.

Sessions

You stay signed in for up to 30 days. Always sign out on shared or public computers.

Under Active sessions on your account page you can see where you are signed in. Select Sign out next to a session, or Sign out other devices to end every session except the one you are using.

How your clients sign in

Client contacts do not have passwords. They sign in with a single-use email link that expires after 15 minutes. Their security depends on their email account, so encourage clients to protect their email with two-factor authentication too.

Sign-in links are only sent to addresses that have been invited. A request for an unknown address gets the same on-screen response, but no email is sent.

Suspicious activity

If you see activity you do not recognize, or think someone else has access to your account:

1. Reset your password.
2. Turn on two-factor authentication if it is off.
3. Check Active sessions on your account page and select Sign out other devices.
4. Check Team (/app/team) and remove anyone who should not be there.
5. Email security@ayebridge.com with what you noticed.

To report a vulnerability in Ayebridge itself, see our security page.