Help CentreSign in

Two-step sign-in

Set up an authenticator app or emailed codes, save your backup codes, switch method, and require it for everyone.

3 min readLast updated

Applies to: Core (every organisation) · Admin, Team member, Providers, Network viewers, Client viewers, External auditors, iComply Super admin, iComply support, iComply billing, iComply compliance officers

On this page

Two-step sign-in asks for a 6-digit code as well as your password, so a stolen password isn't enough.

Who must use it

  • The iComply team, network viewers, client viewers and auditors: always.
  • Everyone at a organisation that requires it. Organisations set up through /start, or by iComply, require it from the start; an admin can make it optional, or require it again, in Settings → Your two-step sign-in (every kind of organisation, clubs, charities and peak bodies included).
  • Anyone else can turn it on, and we recommend it.

How to set it up

  1. Step 1: On Set up two-step sign-in, choose Authenticator app (recommended: most secure, works without signal) or Email me a code (simple, nothing to install).
  2. Step 2: For an app (such as Google Authenticator, Microsoft Authenticator or 1Password): scan the QR code, or enter the key shown, then type the 6-digit code from the app and select Turn on two-step sign-in.
  3. Step 3: For email: select Email a code to your address, then type the 6-digit code from the email and select Turn on two-step sign-in.
  4. Step 4: Save your 8 backup codes with Copy codes or Print, then select I've saved them. Each works once, and we can't show them again.

Signing in

  • App: enter the code your app shows for iComply. It changes every 30 seconds.
  • Email: we email a code as you sign in. No email after a minute? Send a new one; any earlier code stops working.
  • No code? Select Use a backup code. Capitals and dashes don't matter.

Manage it

In Settings → Your two-step sign-in (contractors and providers: their profile page) you can:

  • Make new codes: new backup codes, using a current code. The old ones stop working.
  • Switch: change to emailed codes or to an authenticator app, confirming with your current code first.
  • Turn off: with a current code, unless your organisation requires two-step sign-in (you can switch method instead).
  • With emailed codes, Email me a code sends a code to confirm a switch or turning it off.

Require it for everyone

Admins: in Settings → Your two-step sign-in, under Everyone at your organisation, select Require two-step sign-in for everyone at this organisation. Anyone without it is asked to set it up at their next sign-in, before they can see the register. Make it optional turns the requirement off. Users & access shows each person's two-step status.

Lost your phone?

  • Use Use a backup code on the sign-in screen, then set up your new phone in Settings.
  • Or ask another admin to select Reset next to your name in Users & access. You can't reset your own.
  • iComply team and network accounts must use an authenticator app.

Limits

  • Emailed codes work once, for 10 minutes; 5 wrong tries cancel the code.
  • One emailed code a minute, and up to 5 an hour.
  • Up to 10 wrong codes in 15 minutes: then wait 15 minutes and use the newest code or a backup code.
Every two-step change (turned on, switched, turned off, reset by an admin) is recorded in the audit log. Never share a code: iComply will never ask you for it.
Was this helpful?

Related articles