Help CentreSign in

Two-step sign-in

Set up an authenticator app or emailed codes, save your backup codes, switch method, and require it for everyone.

3 min readLast updated

Applies to: Core (every organisation) · Administrator, Staff and team members, Safety officer (HSEQ), Project or site manager, Gate user, Director or executive, Panel coordinator, Contractors and providers, Network viewers, Client viewers, External auditors, iComply Super admin, iComply support, iComply billing, iComply compliance officers

On this page

Two-step sign-in asks for a 6-digit code as well as your password, so a stolen password isn't enough.

Who must use it

  • The iComply team, network viewers, client viewers and auditors: always.
  • Everyone at a organisation that requires it. Organisations set up through /start, or by iComply, require it from the start; an admin can make it optional, or require it again, in Settings → Your two-step sign-in (every kind of organisation, clubs, charities and peak bodies included).
  • Anyone else can turn it on, and we recommend it.

How to set it up

  1. Step 1: On Set up two-step sign-in, choose Authenticator app (recommended: most secure, works without signal) or Email me a code (simple, nothing to install).
  2. Step 2: For an app (such as Google Authenticator, Microsoft Authenticator or 1Password): scan the QR code, or enter the key shown, then type the 6-digit code from the app and select Turn on two-step sign-in.
  3. Step 3: For email: select Email a code to your address, then type the 6-digit code from the email and select Turn on two-step sign-in.
  4. Step 4: Save your 8 backup codes with Copy codes or Print, then select I've saved them. Each works once, and we can't show them again.

Signing in

  • App: enter the code your app shows for iComply. It changes every 30 seconds.
  • Email: we email a code as you sign in. No email after a minute? Send a new one; any earlier code stops working.
  • No code? Select Use a backup code. Capitals and dashes don't matter.

Manage it

In Settings → Your two-step sign-in (contractors and providers: their profile page) you can:

  • Make new codes: new backup codes, using a current code. The old ones stop working.
  • Switch: change to emailed codes or to an authenticator app, confirming with your current code first.
  • Turn off: with a current code, unless your organisation requires two-step sign-in (you can switch method instead).
  • With emailed codes, Email me a code sends a code to confirm a switch or turning it off.

Require it for everyone

Admins: in Settings → Your two-step sign-in, under Everyone at your organisation, select Require two-step sign-in for everyone at this organisation. Anyone without it is asked to set it up at their next sign-in, before they can see the register. Make it optional turns the requirement off. Users & access shows each person's two-step status.

Lost your phone?

  • Use Use a backup code on the sign-in screen, then set up your new phone in Settings.
  • Or ask another admin to select Reset next to your name in Users & access. You can't reset your own.
  • iComply team and network accounts must use an authenticator app.

Limits

  • Emailed codes work once, for 10 minutes; 5 wrong tries cancel the code.
  • One emailed code a minute, and up to 5 an hour.
  • Up to 10 wrong codes in 15 minutes: then wait 15 minutes and use the newest code or a backup code.
Every two-step change (turned on, switched, turned off, reset by an admin) is recorded in the audit log. Never share a code: iComply will never ask you for it.
Was this helpful?

Related articles