A password is no longer enough

A DocuTract account holds passport scans, registry extracts and the contracts made from them. Until today the only thing standing between those documents and anyone else was a password, and passwords leak: they are reused, typed into the wrong page, or written on a sticky note next to the monitor.

Now a password alone does not open the account.

Set it up once

Open Profile and find Two-factor authentication. Click Set up an authenticator app, and DocuTract shows a QR code. Scan it with any authenticator app: Google Authenticator, 1Password, Authy, Microsoft Authenticator or the one built into your password manager. If the camera is not an option, the same screen shows a key you can type in.

The app then shows a six-digit code that changes every thirty seconds. Enter the current one to confirm, and two-factor authentication is on.

What changes when you sign in

After the password, or after signing in with Google, or after following a sign-in link from an email, DocuTract asks for the code from the app. The code is checked once per session; you are not asked again while you work.

Someone who has only your password gets as far as that screen and no further.

For the whole team

A workspace owner can go one step further. In Workspace settings → Security, switch on Require two-factor authentication for every member. From that moment a member who has not set up an authenticator sees a screen asking them to do it before the workspace opens, and nothing inside it is reachable until they have.

Two details that matter in practice:

• The owner goes first. The switch only turns on once the owner's own account has two-factor authentication, so nobody locks themselves out of their own workspace.
• It is per workspace. If you are a member of several teams, each owner decides for their own workspace.

Our side of it

Our own administrators have been required to use a second factor to open the admin panel from the day this shipped. The rule we apply to ourselves is the one we recommend to you.

If you change your phone

Before you reset or replace the phone, turn two-factor authentication off in Profile and set it up again on the new one: it takes a minute. If the phone is already gone, write to us from the email address of your account and we will help you back in once we have confirmed it is you.

The step by step is in the help centre.