Account, team, and security
Security, 2FA, and passkeys
Turn on two-factor authentication, add Face ID or Touch ID, set auto-lock, manage sessions and sign-out, and understand password expiry and lockouts.
Settings > Security is the Security Controls page.
Two-factor authentication
2FA Setup shows a QR code. Scan it with an authenticator app (any TOTP app works), enter the six-digit code, and save the backup codes somewhere safe. From then on sign-in asks for a code after the password. Regenerate 2FA replaces the secret after you confirm the current code.
Face ID, Touch ID, and passkeys
Set Up Face ID / Touch ID registers a passkey on the device. It is faster than a code, more secure than a password, works alongside your 2FA, and can be registered on several devices. Each credential shows when it was last used and can be removed.
Auto-lock
Lock the app automatically after inactivity; choose the timeout. On iPhone and iPad the lock uses biometrics.
Sessions
Each sign-in is its own session. Signing out ends only that session, so a colleague signed in as the same account elsewhere is not affected; sessions idle out after inactivity. Sign out everywhere ends them all.
Password rules
At least 8 characters with uppercase, lowercase, a number, and a special character; expiry after 90 days by default. Repeated failed attempts lock the account for a period. See Team accounts and sign-in problems.
Privacy Dashboard
Open Privacy Dashboard to review the data Sefton holds about your account and the permissions you granted.
Frequently asked questions
I changed phones and lost my authenticator. What now?
Sign in with a backup code if you saved one. Otherwise open a support ticket; support resets 2FA for your account and you set it up again.
Why did Sefton say my password expired?
Passwords expire after 90 days by default. Use Forgot password to set a new one; the expiry clock restarts from that reset.