Securing your account

Click the cog icon at the top right of the portal, next to the bell, then click Security in the list on the left of the Settings page. It is the fourth item, under Notifications. The page has four boxes, top to bottom: Two-Factor Authentication, Login Location Restriction, Active Sessions and Change Password. Each box fetches its own settings when the page opens, so for a moment you may see "Loading two-factor authentication status…", "Loading login location restriction…" or "Loading sessions…". If you move to another Settings page part way through a step, the step is abandoned and the box goes back to its starting view when you return.

Click Enable 2FA. The box asks you to confirm your password first: type it under Password and click Continue (it shows "Verifying…" while checking). A wrong password shows "Incorrect password." in red and you can try again. Cancel takes you back with nothing changed.

Next you see a QR code. Open your authenticator app, choose to add an account, and scan the code with your phone's camera. If you cannot scan it, the key shown under "CAN'T SCAN? ENTER THIS KEY MANUALLY:" can be typed into the app instead. The app then starts showing a six-digit code that changes every 30 seconds. Click I've scanned it, next. Two-factor is not on yet at this point: if you click Cancel here, nothing has been switched on.

Type the current six-digit code from your app under Verification Code and click Verify & Enable. The button stays greyed out until you have typed all six digits. If the code is refused you will see "Invalid code. Check your authenticator app and try again.": wait for the app to show a fresh code and type that one. Back returns you to the QR code.

When the code is accepted, "Two-factor authentication enabled." appears at the bottom of the screen and the box shows your eight recovery codes. Each one is eight characters in the form XXXX-XXXX. Click Copy codes to copy all eight, then paste them somewhere safe, such as a password manager or a printed sheet kept away from your desk. Click Done when you have saved them.

Important: The recovery codes are shown once. There is no way to see them again or to make a new set, other than turning two-factor off and on again. If you lose your phone and have no recovery codes, you cannot get back into the portal.

After you enter your email and password, the sign-in screen shows Two-factor authentication with six boxes and the line "Enter the 6-digit code from your authenticator app." Open your app, type the code shown, and click Verify. You have five minutes after entering your password to enter the code; after that, start again from your email and password. A wrong code shows "Invalid code. Please try again."

If you do not have your phone, click Use a recovery code instead under "Lost your device?". The screen changes to "Enter one of the recovery codes you saved when you set up two-factor authentication." with one box: type a code in the form XXXX-XXXX and click Verify. That code is then used up and will not work again; the count on the Security page drops by one. Use your authenticator code takes you back to the six boxes.

Tip: Once you are down to your last few recovery codes, turn two-factor off and on again to get a fresh set of eight, and save them.

Once two-factor is on, the Two-Factor Authentication box shows a green Enabled with the number of recovery codes you have left, and a red Disable button at the right. You might turn it off to get a fresh set of recovery codes, before changing phones, or if the extra step is not wanted. Click Disable to start.

A red note reminds you that you will only need your password to sign in from then on. Type your password under Confirm your password to disable 2FA and click Disable 2FA. "Two-factor authentication disabled." appears at the bottom of the screen, the box goes back to Not enabled, and your recovery codes are discarded. Cancel leaves everything as it was.

The Login Location Restriction box lets you allow sign-ins only from the countries your company works in. Turn on Enable geo-restriction and a list of 21 countries appears under Allowed countries:, from United Kingdom to United Arab Emirates. Click a country to allow it; it turns green. Click it again to remove it. Only countries in the list can be chosen. The Save Changes button appears as soon as your choices differ from what is saved; click it and "Login restriction updated." confirms. No password is asked for.

With the switch on you must keep at least one country chosen: the box shows "No countries selected. You must select at least one country or disable the restriction." in red until you do, and saving with none chosen is refused. With the switch off, an amber note reads "Geo-restriction is disabled. Logins are allowed from any country. Enabling this is recommended for security."

How it works:

• The check happens at sign-in only. DoorTRACE looks at the country the connection appears to come from. If it is not in your list, the sign-in is refused with "Login is not permitted from your current location. Contact your administrator if you believe this is an error." and counts as a failed attempt.
• It applies to every sign-in to your company, including your own engineers signing in to the engineer app and external engineers choosing your company in the app.
• Anyone already signed in stays signed in. The restriction only stops new sign-ins.
• If the country cannot be worked out, the sign-in is allowed.

Important: A VPN, a phone on roaming, or a trip abroad can put you outside your own list. If you or an engineer are refused while travelling, sign in from an allowed country and add the one you need, or turn the restriction off for the trip.

The Active Sessions box lists every browser currently signed in with your company's login. Each row shows the browser and device, such as "Chrome on Windows", with the connection's IP address and when it was last active: "Active now", "9m ago", "2h ago", "Yesterday" or "3d ago". The row for the browser you are using is listed first and marked Current in green; it has no Revoke button because you end it by signing out. When there are more than eight rows, Show N more sessions opens the rest.

Click Revoke next to any row you do not recognise, or on a device you no longer have. "Session revoked." confirms. That browser is signed out the next time it checks in with DoorTRACE, which it does every 13 minutes while a tab is open, so within about 15 minutes it sees "Session expired" with a Sign in button.

A few things worth knowing:

• Sessions expire after 12 hours. A browser that is still open renews its sign-in in the background, and each renewal starts a fresh 12 hours, so the clock really runs from the last time the portal was open. "9m ago" on your own row is normal.
• Remember me on the sign-in screen keeps you signed in after you close the browser. Without it, the sign-in belongs to that browser tab and is gone when the tab closes.
• To sign out, click the arrow icon next to your company name at the bottom of the menu on the left, then Sign out in the window that asks "Are you sure you want to sign out of the portal?". That ends only the browser you click it in. Other devices stay signed in until you revoke them here, or until they expire.
• Your engineers' phones are not listed here. The engineer app has its own login.

In the Change Password box, type your current password under Current Password, then your new one under New Password. As you type, four lines under the box turn green as each rule is met: At least 8 characters, One uppercase letter, One lowercase letter, One number. Type the new password again under Confirm New Password and click Update Password (it shows "Changing…" while saving).

If a box is empty you will see "All fields are required." If the new password misses a rule, the message names it, for example "New password does not meet the rules: one number." If the two new passwords differ, "New passwords do not match." If the current password is wrong, "Current password is incorrect".

Important: A successful change signs you out everywhere. "Password changed. Please sign in again." appears, the portal signs you out a moment later, and every other browser signed in with your login is ended too. Sign back in with the new password.