Account security

Your account holds your company's time entries and employment data, so it deserves more than just a password. Everything in this guide is done from your profile menu: Security and 2-step verification, Active sessions and Change password.

Two-step verification

With two-step verification, after entering your password we'll ask you for a one-time code. You can choose between two methods:

• Authenticator app (TOTP): 6-digit codes that change every 30 seconds, generated by Google Authenticator, Authy, 1Password or any compatible app. This is the recommended method: it works without signal or email.
• Email code: on every sign-in we send a 6-digit code to your inbox, valid for 10 minutes.

Enabling the authenticator app method

1. Go to Security and 2-step verification from your profile.
2. Choose the authenticator app option. You'll see a QR code and, if you can't scan it, the secret key to enter by hand.
3. Scan the QR with your app and type in the 6-digit code it shows to confirm activation.
4. Save the recovery codes displayed next.

Until you confirm the code, verification stays pending and your sign-in keeps working with just your password. If you change your mind at that point, you can simply cancel it.

Enabling the email method

It's a single click on the same screen: no prior confirmation is required, and you also receive your recovery codes when enabling it.

Recovery codes

When you enable either method, 10 recovery codes in xxxx-xxxx format are generated. Each one is good for a single sign-in if you lose your phone or access to your email: on the code screen, use the recovery code option.

The codes are shown only once, at the moment they're generated; they're stored encrypted and can't be viewed again. Write them down in a password manager or print them. If you lose them, you can regenerate them from the same screen (the old ones stop working).

Mandatory for administration, HR, legal representatives and support

If your role is administration or HR, if you have the legal representative flag (with any role) or you are AccessTime support, two-step verification is mandatory: you have access to the whole workforce's data (or your workplaces'). After logging in we take you to this screen until you enable it, and afterwards you can change the method, but not turn it off. The mobile clock-in app keeps working as before.

Lost your phone and your recovery codes? Whoever manages your account at the company (or AccessTime support, if you are the only administrator) can reset it from your record, stating the reason; we will notify you by email and you will set it up again when you log in.

Disabling verification

From the same screen, by entering your current password. Disabling it also deletes the secret and the recovery codes.

Active sessions and remote sign-out

Active sessions shows every session open with your account, sorted by last activity, with the current session highlighted. From there you can:

• Sign out of a specific session (any except the one you're using): handy if you left your account open on a shared computer.
• Sign out of all other sessions at once, confirming with your current password. The session you do it from stays alive.

Sessions that expire due to inactivity disappear from the list on their own.

Devices with access (mobile app)

In Devices with access you can see the phones with the AccessTime app connected to your account, with their last activity and the date their access expires. Each app access expires after 90 days: the app then asks for your password again, without losing clock-ins waiting to be sent. You can revoke a specific device or all of them at once (with your password). Signing out all other sessions also signs the app out on the phones.

My clock-in QR code

If your company uses the kiosk, My clock-in QR code shows the code you hold up to the camera to clock in. It is personal: if you lose it or think someone has photographed it, renew it and the previous one stops working immediately.

Changing your password

1. Go to Change password from your profile.
2. Enter your current password and the new one twice. The new one must be at least 10 characters long and different from the current one.
3. On save, for security all your other sessions are signed out (the current one stays) and you receive a notification email in your language.

The change is recorded in your company's audit history. If you receive the notification email without having changed the password yourself, reset it immediately and check your Active sessions.

If you can't remember your password, use the recovery link on the sign-in screen: we'll send you an email to reset it.

Automatic access protections

On top of what you configure, the platform applies these defences out of the box:

Next steps

• If you've just created your account, review the getting started guide.
• Administrators manage team onboarding and offboarding in Employees.