> ## Documentation Index > Fetch the complete documentation index at: https://docs.usertick.com/llms.txt > Use this file to discover all available pages before exploring further. # Security and sign-in > Sign-in, email codes, two-factor authentication, signed-in devices, accounts managed through single sign-on and where your data is stored. ## Sign in Usertick accounts sign in with an email address and password, or with Google. When your organization has set up single sign-on, people at its email domain can also sign in through its identity provider with **Sign in with SSO** (see [Single sign-on and SCIM](https://docs.usertick.com/workspace/single-sign-on.md)). A short code verifies the email address at signup. An account that signs in with Google has no password until one is set: **Set password** under **Settings → Security** adds one, and the account then signs in with either. ### Email codes Every code Usertick emails has 6 digits and works for 15 minutes, and the screen that asks for it counts down the time left. Pasting the code into the first box fills all six, and browser and phone autofill work too. On the signup and sign-in screens, the code is checked as soon as the last digit is entered. If a code doesn't arrive, **Send a new code** becomes available a minute after the last one was sent. A new code replaces the old one and starts a fresh 15 minutes. If you leave before confirming, signing in later with your email and password sends a fresh code and returns you to the code screen. ### Reset a forgotten password **Forgot password?** on the sign-in screen opens the reset form with the email address you already typed, and sends a reset link to that address. Usertick sends no link to an account that single sign-on manages, or to an address whose organization requires single sign-on. ### Change your email address **1. Enter the new address** In **Settings → Profile**, enter the new address in **Email** and select **Save changes**, and the **Change email** dialog opens. **2. Request the codes** Select **Send codes**, and Usertick sends a 6-digit code to the current address and another to the new address. **3. Confirm** Enter the code from each inbox and select **Confirm change**. After the change, Usertick sends a security notice to the old address. Pending invitations to the old address are revoked, and scheduled reports that went to it go to the new address. If the account signed in with Google, Google sign-in stops working for it, and the account signs in with the new address and its password. The email address can't be changed in two cases: * The account has no password. Set one under **Settings → Security** first. * Single sign-on manages the address. See [Accounts managed through single sign-on](#accounts-managed-through-single-sign-on). ## Turn on two-factor authentication Two-factor authentication is available on every plan. **1. Start the setup** Under **Settings → Security**, select **Enable two-factor**. **2. Scan the QR code** Scan the QR code with an authenticator app, then enter the 6-digit code it shows and select **Enable**. **3. Save the recovery codes** Keep the recovery codes in a safe place. From then on, every sign-in with a password or Google asks for the 6-digit code, which can be typed or pasted into the boxes. A sign-in through single sign-on doesn't ask for it, because your identity provider's own checks apply. If you lose access to the authenticator app, **Lost access to your app? Use a recovery code** accepts one of the recovery codes instead. **Disable two-factor** under **Settings → Security** turns it off after your password and a code. It is not offered while an organization you belong to requires two-factor authentication. ### Codes inside the dashboard With two-factor authentication on, Usertick asks for a code again before a change that hands out lasting access or changes who can get in: * Changing your password or your email address. * Creating, rotating or changing the access of an API key, creating, rotating or deleting an identity key, changing the identity verification mode, creating or editing a webhook, rotating a webhook secret, and approving a connected app. * Inviting a person or adding a member, changing a member's role, and creating or editing a role. * Saving or disconnecting single sign-on, and generating, rotating or turning off the SCIM token. * Transferring ownership, requiring two-factor authentication for the organization, opening checkout or the billing portal, and changing the plan. The **Two-factor authentication** window accepts a code from the authenticator app or a recovery code. After a correct code, the same device is not asked again for 5 minutes, and a sign-in with a code counts as one. Replacing the authenticator and replacing the recovery codes ask every time. An authenticator code works once. If Usertick asks again before the app shows a new code, wait for the next one. After 5 incorrect codes in 15 minutes, or 20 in 24 hours, Usertick accepts no authenticator code until that time has passed. A recovery code still works. ### Move to a new phone or app **1. Start the replacement** Under **Settings → Security**, select **Replace authenticator** and enter your password. **2. Confirm with the authenticator you use now** Enter a code from the current authenticator app. If you no longer have it, enter a recovery code. **3. Scan the new QR code** Scan the QR code with the new app, enter the code it shows and select **Replace**. **4. Save the new recovery codes** The earlier recovery codes stop working with the old authenticator. Every other device is signed out when the replacement is done. ### Replace the recovery codes The **Recovery codes** row under **Settings → Security** shows how many codes are left. **New recovery codes** issues a new set after a code from your authenticator app. The earlier codes stop working, and the new ones are shown once. ### Emails about sign-in changes Usertick emails the account's address when its password is changed or added, when two-factor authentication is turned on or off, when the authenticator or the recovery codes are replaced, and when a sign-in is completed with a recovery code. Each email says what to do if the change was not yours. ## Require two-factor authentication for an organization The owner can require two-factor authentication of every member, on every plan. Under **Settings → Organization**, turn on **Require two-factor authentication** and select **Save changes**. The owner's own account needs two-factor authentication first. The row shows how many members have two-factor authentication off, and **View members** opens **Settings → People**, where the line of each such member says "Two-factor off". While the requirement is on: * Usertick emails each member whose account has two-factor authentication off when the requirement is turned on. * A member without two-factor authentication sees "*Organization* requires two-factor authentication" in place of the organization's pages. **Open security settings** leads to the setup, and the organization opens when two-factor authentication is on. **Leave organization** on the same screen is the other way out. A person who accepts an invitation sees the same screen. * Members can't turn two-factor authentication off. **Replace authenticator** still moves it to another phone or app. * An account with no password that your organization manages through single sign-on is not asked. Its second step is your identity provider's. See [Accounts managed through single sign-on](#accounts-managed-through-single-sign-on). The activity log records when the requirement is turned on and off. ## Sign out a device **Signed-in devices** under **Settings → Security** lists every device signed in to your account, with its browser, location and last activity. **Sign out** signs a device out within a minute, and **Sign out others** signs out every device except the current one. If an account is banned or deactivated, all of its sessions end immediately. ## Single sign-on and SCIM On the Business plan, the owner can connect the organization to a SAML 2.0 identity provider, such as Okta, Microsoft Entra ID or Google Workspace, and let it add and remove members with SCIM. The setup is under **Settings → Developers → SSO and SCIM**. See [Single sign-on and SCIM](https://docs.usertick.com/workspace/single-sign-on.md). ## Accounts managed through single sign-on Once your organization has verified its email domain for single sign-on, and while its plan includes single sign-on, your organization manages an account when all of these apply: * The account's email address is at the verified domain, and the account is a member of your organization or was created through single sign-on or SCIM. * The account has no password. * The account is not the organization's owner. A managed account signs in only through your identity provider, and Usertick limits what it can do: * It can't sign in with Google, also when Google was how it signed in before, and Google can't be linked to it. * It can't set a password, and **Forgot password?** sends it no reset link. **Settings → Security** says "This account signs in through your organization's single sign-on, so it has no password." * It can't delete itself. An administrator removes the person at the identity provider or from the members list. * It can't create an organization, and the ownership of another organization can't be transferred to it. It can still be invited to other organizations as a member. These limits hold also while single sign-on waits for a new test sign-in after the provider details change, so a certificate change never opens another way in. An account that has its own password stays the person's own, also inside such an organization, and keeps signing in with its password unless the organization requires single sign-on. The owner is never a managed account, so the owner can set a password and sign in with it when the identity provider is unavailable. Inside your organization, ownership can be transferred to a managed account, and as the owner it is no longer managed. The email address of every account at the verified domain that belongs to your organization, managed or otherwise, can't be changed in Usertick. ### Required single sign-on When the owner turns on **Require single sign-on**, every address at the domain signs in only through the identity provider, from its next sign-in and while single sign-on is on. Usertick then refuses password and Google sign-in, Google sign-up, linking Google, finishing a sign-up with the email code and setting a password for those addresses, whether the account is a member of the organization or not, and **Forgot password?** sends no link. The owner is exempt. See [Require single sign-on](https://docs.usertick.com/workspace/single-sign-on.md#require-single-sign-on). ### When the account leaves its last organization When an account that single sign-on or SCIM created leaves its last organization, Usertick schedules the account for deletion 30 days later and emails its address. Signing in before then cancels the deletion, and so does being restored through SCIM. ## Access control and the activity log Roles and permissions control what each member can do (see [Members and roles](https://docs.usertick.com/workspace/members-and-roles.md)), and the activity log records every change with the person who made it and when. ## Where data is stored Usertick stores customer data in the United Kingdom, and uploaded files in the European Union. Data is encrypted in transit and at rest, and every request is limited to its own organization's data. The AI features run in the United Kingdom, except the AI reading of survey answers, which runs in the United States under a data processing agreement with the UK transfer addendum. Neither Usertick nor its AI providers train models on your data. Usertick processes your customers' and visitors' personal data as your processor under the [Data Processing Addendum](https://usertick.com/dpa), which applies to every plan, and the [sub-processors page](https://usertick.com/subprocessors) lists every provider with what it does and where. Usertick's hosting providers are certified under ISO 27001 and SOC 2; Usertick doesn't hold these certifications itself, and it doesn't sign HIPAA business associate agreements. Security reports go to [security@usertick.com](mailto:security@usertick.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.