Account security

The short answer

Two-factor authentication with an authenticator app is optional and personal: no plan or organization requires it. One sign-in has one active session, so signing in somewhere new signs the previous session out. A session lasts seven days from its last use and thirty days at most from sign-in. Sign out everywhere ends every session of yours, this browser’s included. A forgotten password is reset by a one-hour link sent to your address.

Two-factor authentication

Turning it on asks for your password, then for a six-digit code from an authenticator app. You are then shown a set of backup codes once and never again; each signs you in once when the device is not to hand. Store them somewhere other than the device. Turning two-factor off, or replacing the backup codes, also asks for your password first. On the sign-in screen, Trust this browser skips the second step on that browser.

Repeated wrong codes lock the second factor for a short time. It unlocks by itself; nobody has to reset it.

Sessions

The app allows one active session per sign-in. If you use two devices, signing in on the second signs the first out; sign in again when you return to it. Sign out everywhere ends only your own sessions. It does not sign out other members of your organization.

Sign-in has no lockout. After ten failed attempts for one address within an hour, sign-in for that address pauses for a time and then works again by itself.

Resetting a password

Use the password-reset link on the sign-in screen and enter your address. If an account exists for it, a link is sent that works once and lasts one hour. Setting a new password signs out every session of yours, and a confirmation is sent to your address. A reset does not revoke your API keys: the confirmation lists the keys you hold, so you can revoke any that is not yours. A password must be at least ten characters.

Changing your email address

From Your account → Profile, enter the new address. A link goes to the new address and lasts one hour, and the old address is told that a change was asked for. The old address stays in place until you follow the link; your memberships are unaffected. Data Tactical Group staff do not change an address by hand.

If you think someone else has signed in

Reset your password, which ends every session, and turn on two-factor authentication. If an API key may have been exposed, revoke it (see API keys). Then write to support@datatactical.group so a person can look at it with you.

Roles and what each can do are on organizations and members. What is in place across the service, and how to report a vulnerability, is on the security page.