Sign in and turn on two step sign in

Your firm signs in at its own address. Use the address your firm gave you when your account was made; there is no sign in on this site.

If your firm uses Microsoft or Google single sign-on, choose its provider button. Read Single sign-on for provider MFA, required mode and emergency password access.

Your first sign in

1. Open the invitation email your firm's administrator sent. The link in it works once and lasts 72 hours; if it has expired, ask them to send it again.
2. Choose a password of at least 12 characters. A long phrase is easier to remember and harder to guess than a short word with symbols.
3. Sign in with your email address and the new password.

Where you land

After signing in you reach your dashboard, or the page you chose to start on in your preferences. Your dashboard explains what it shows.

Turn on two step sign in

Two step sign in asks for a second proof after your password, so a stolen password alone does not open your account. It is your choice, and the firm may ask everyone to use it.

1. Open your name at the top of the screen or at the foot of the menu, then Security.
2. Under Two-factor authentication, choose Set up beside Authenticator app and scan the code with an app such as Google Authenticator or Microsoft Authenticator, or beside Email codes to receive a code by email each time.
3. Enter the code the app shows to confirm it works.
4. Save the ten recovery codes somewhere safe. Each works once, and they are the way back in if you lose your phone.

If you are locked out

• Ten failed attempts in fifteen minutes lock the account for a while. Wait, or ask an administrator to unlock it.
• Forgot your password: use Forgot your password? on the sign in page. The link lasts 30 minutes, works once, and still asks for your second step.
• Lost your phone: sign in with a recovery code, or ask an administrator to reset your two step sign in. They must confirm their own identity first, and you are told when it happens.

What you will see afterwards

A sign in from a new device or an unusual address sends you an email. Your Sessions page lists every place you are signed in, with the device, the address and, where it can be read, roughly where it was (such as "Kumasi, Ghana"), and you can end any of them. A place you do not recognise is a reason to end that session and change your password. The same rough place shows beside each sign in on your Security page and, for administrators, on each account's sign-ins and the firm's sign-in log. A session ends after 60 minutes without activity and after 12 hours in any case, unless your firm has set different times.

For administrators: the firm's sign-ins

Settings, Security, Login attempts lists the firm's recent sign in attempts, failures included, with roughly where each came from, so an administrator can see an account under attack. The list exports like any register. Each person's own sign-ins are on their record under People, Access, Sign-ins.