Skip to main content

​
Sign in

Usertick accounts sign in with an email address and password, or with Google. When your organization has set up single sign-on, people at its email domain can also sign in through its identity provider with Sign in with SSO (see Single sign-on and SCIM). A short code verifies the email address at signup. An account that signs in with Google has no password until one is set: Set password under Settings → Security adds one, and the account then signs in with either.

​
Email codes

Every code Usertick emails has 6 digits and works for 15 minutes, and the screen that asks for it counts down the time left. Pasting the code into the first box fills all six, and browser and phone autofill work too. On the signup and sign-in screens, the code is checked as soon as the last digit is entered. If a code doesn’t arrive, Send a new code becomes available a minute after the last one was sent. A new code replaces the old one and starts a fresh 15 minutes. If you leave before confirming, signing in later with your email and password sends a fresh code and returns you to the code screen.

​
Reset a forgotten password

Forgot password? on the sign-in screen opens the reset form with the email address you already typed, and sends a reset link to that address. Usertick sends no link to an account that single sign-on manages, or to an address whose organization requires single sign-on.

​
Change your email address

1

Enter the new address

In Settings → Profile, enter the new address in Email and select Save changes, and the Change email dialog opens.
2

Request the codes

Select Send codes, and Usertick sends a 6-digit code to the current address and another to the new address.
3

Confirm

Enter the code from each inbox and select Confirm change.
After the change, Usertick sends a security notice to the old address. Pending invitations to the old address are revoked, and scheduled reports that went to it go to the new address. If the account signed in with Google, Google sign-in stops working for it, and the account signs in with the new address and its password. The email address can’t be changed in two cases:

​
Turn on two-factor authentication

Two-factor authentication is available on every plan.
1

Start the setup

Under Settings → Security, select Enable two-factor.
2

Scan the QR code

Scan the QR code with an authenticator app, then enter the 6-digit code it shows and select Enable.
3

Save the recovery codes

Keep the recovery codes in a safe place.
From then on, every sign-in with a password or Google asks for the 6-digit code, which can be typed or pasted into the boxes. A sign-in through single sign-on doesn’t ask for it, because your identity provider’s own checks apply. If you lose access to the authenticator app, Lost access to your app? Use a recovery code accepts one of the recovery codes instead. Disable two-factor under Settings → Security turns it off after your password and a code. It is not offered while an organization you belong to requires two-factor authentication.

​
Codes inside the dashboard

With two-factor authentication on, Usertick asks for a code again before a change that hands out lasting access or changes who can get in:
  • Changing your password or your email address.
  • Creating, rotating or changing the access of an API key, creating, rotating or deleting an identity key, changing the identity verification mode, creating or editing a webhook, rotating a webhook secret, and approving a connected app.
  • Inviting a person or adding a member, changing a member’s role, and creating or editing a role.
  • Saving or disconnecting single sign-on, and generating, rotating or turning off the SCIM token.
  • Transferring ownership, requiring two-factor authentication for the organization, opening checkout or the billing portal, and changing the plan.
The Two-factor authentication window accepts a code from the authenticator app or a recovery code. After a correct code, the same device is not asked again for 5 minutes, and a sign-in with a code counts as one. Replacing the authenticator and replacing the recovery codes ask every time. An authenticator code works once. If Usertick asks again before the app shows a new code, wait for the next one. After 5 incorrect codes in 15 minutes, or 20 in 24 hours, Usertick accepts no authenticator code until that time has passed. A recovery code still works.

​
Move to a new phone or app

1

Start the replacement

Under Settings → Security, select Replace authenticator and enter your password.
2

Confirm with the authenticator you use now

Enter a code from the current authenticator app. If you no longer have it, enter a recovery code.
3

Scan the new QR code

Scan the QR code with the new app, enter the code it shows and select Replace.
4

Save the new recovery codes

The earlier recovery codes stop working with the old authenticator.
Every other device is signed out when the replacement is done.

​
Replace the recovery codes

The Recovery codes row under Settings → Security shows how many codes are left. New recovery codes issues a new set after a code from your authenticator app. The earlier codes stop working, and the new ones are shown once.

​
Emails about sign-in changes

Usertick emails the account’s address when its password is changed or added, when two-factor authentication is turned on or off, when the authenticator or the recovery codes are replaced, and when a sign-in is completed with a recovery code. Each email says what to do if the change was not yours.

​
Require two-factor authentication for an organization

The owner can require two-factor authentication of every member, on every plan. Under Settings → Organization, turn on Require two-factor authentication and select Save changes. The owner’s own account needs two-factor authentication first. The row shows how many members have two-factor authentication off, and View members opens Settings → People, where the line of each such member says “Two-factor off”. While the requirement is on:
  • Usertick emails each member whose account has two-factor authentication off when the requirement is turned on.
  • A member without two-factor authentication sees “Organization requires two-factor authentication” in place of the organization’s pages. Open security settings leads to the setup, and the organization opens when two-factor authentication is on. Leave organization on the same screen is the other way out. A person who accepts an invitation sees the same screen.
  • Members can’t turn two-factor authentication off. Replace authenticator still moves it to another phone or app.
  • An account with no password that your organization manages through single sign-on is not asked. Its second step is your identity provider’s. See Accounts managed through single sign-on.
The activity log records when the requirement is turned on and off.

​
Sign out a device

Signed-in devices under Settings → Security lists every device signed in to your account, with its browser, location and last activity. Sign out signs a device out within a minute, and Sign out others signs out every device except the current one. If an account is banned or deactivated, all of its sessions end immediately.

​
Single sign-on and SCIM

On the Business plan, the owner can connect the organization to a SAML 2.0 identity provider, such as Okta, Microsoft Entra ID or Google Workspace, and let it add and remove members with SCIM. The setup is under Settings → Developers → SSO and SCIM. See Single sign-on and SCIM.

​
Accounts managed through single sign-on

Once your organization has verified its email domain for single sign-on, and while its plan includes single sign-on, your organization manages an account when all of these apply:
  • The account’s email address is at the verified domain, and the account is a member of your organization or was created through single sign-on or SCIM.
  • The account has no password.
  • The account is not the organization’s owner.
A managed account signs in only through your identity provider, and Usertick limits what it can do:
  • It can’t sign in with Google, also when Google was how it signed in before, and Google can’t be linked to it.
  • It can’t set a password, and Forgot password? sends it no reset link. Settings → Security says “This account signs in through your organization’s single sign-on, so it has no password.”
  • It can’t delete itself. An administrator removes the person at the identity provider or from the members list.
  • It can’t create an organization, and the ownership of another organization can’t be transferred to it. It can still be invited to other organizations as a member.
These limits hold also while single sign-on waits for a new test sign-in after the provider details change, so a certificate change never opens another way in. An account that has its own password stays the person’s own, also inside such an organization, and keeps signing in with its password unless the organization requires single sign-on. The owner is never a managed account, so the owner can set a password and sign in with it when the identity provider is unavailable. Inside your organization, ownership can be transferred to a managed account, and as the owner it is no longer managed. The email address of every account at the verified domain that belongs to your organization, managed or otherwise, can’t be changed in Usertick.

​
Required single sign-on

When the owner turns on Require single sign-on, every address at the domain signs in only through the identity provider, from its next sign-in and while single sign-on is on. Usertick then refuses password and Google sign-in, Google sign-up, linking Google, finishing a sign-up with the email code and setting a password for those addresses, whether the account is a member of the organization or not, and Forgot password? sends no link. The owner is exempt. See Require single sign-on.

​
When the account leaves its last organization

When an account that single sign-on or SCIM created leaves its last organization, Usertick schedules the account for deletion 30 days later and emails its address. Signing in before then cancels the deletion, and so does being restored through SCIM.

​
Access control and the activity log

Roles and permissions control what each member can do (see Members and roles), and the activity log records every change with the person who made it and when.

​
Where data is stored

Usertick stores customer data in the United Kingdom, and uploaded files in the European Union. Data is encrypted in transit and at rest, and every request is limited to its own organization’s data. The AI features run in the United Kingdom, except the AI reading of survey answers, which runs in the United States under a data processing agreement with the UK transfer addendum. Neither Usertick nor its AI providers train models on your data. Usertick processes your customers’ and visitors’ personal data as your processor under the Data Processing Addendum, which applies to every plan, and the sub-processors page lists every provider with what it does and where. Usertick’s hosting providers are certified under ISO 27001 and SOC 2; Usertick doesn’t hold these certifications itself, and it doesn’t sign HIPAA business associate agreements. Security reports go to [email protected].