Privacy & security

What the page is for

The tab does two things: the customer can turn on two-factor sign-in for his own account, and he can open the documents that apply to his use of the platform. It is also where the shield at the top of the app and on the web leads. The tab is open to both the owner and the employees, because two-factor sign-in belongs to the individual user, not to the company.

In the menu the Privacy & security tab sits in the ACCOUNT section, just above Language and time zone. The TRAINING CAMP section at the top of the menu holds, among others, Your business and, for the owner, Products and services.

What it looks like

The heading "Privacy & security" with the line "Manage your privacy settings and security."

Then the SECURITY section with the card Two-factor authentication (2FA), the line "Extra security with authenticator app" and a badge that reads Enabled or Not enabled. Below the card is the button Enable 2FA (or Disable 2FA if it is already on) and a line about what 2FA does.

Lowest down, the PRIVACY section with links that open in a new tab:

• Direct customer: Privacy policy and Terms of service.
• Customer at a partner: the partner's OWN Privacy policy and, if the partner has added it, Data processing agreement. If the partner has no policy address, no links are shown, and the section disappears entirely. Trading terms are deliberately not shown: price and cancellation are an agreement between the agency and the customer and sit outside the app.

Buttons and fields

Enable 2FA

Starts the setup. The screen changes to Set up 2-factor authentication with a QR code that the customer scans with his authenticator app (for example Google Authenticator, Authy or 1Password). If the code cannot be scanned, the same key is shown as text under "Can't scan? Enter this code manually:" with the button Copy code. The customer then enters the 6-digit code from the app and presses Enable 2FA. If it works, "Two-factor sign-in is now on" is shown, and the badge changes to Enabled. If the code is wrong, "Invalid code. Try again." is shown, and nothing changes. Cancel stops the setup, so 2FA is NOT turned on.

Disable 2FA

Asks "Disable 2-factor authentication?" and warns that the account becomes less secure. Yes, disable turns it off and shows "Two-factor sign-in is now off". Cancel closes without changing anything. After that the customer signs in with only email and password.

Privacy policy, Terms of service, Data processing agreement

Links that open the document in a new tab. They change nothing and save nothing. For a customer at a partner they point to the partner's own documents.

What the customer sees afterwards

If 2FA is on, the customer is asked for a code from his authenticator app every time he signs in to that account. It applies only to the user who turned it on: an employee with 2FA changes nothing for the owner, and the other way round. In the app the red shield next to the profile picture disappears when 2FA is on. On the web the mark stays, but changes from a red shield ("2FA not enabled - Click to enable") to a green one ("2FA enabled - Your account is protected").

If the customer loses his phone without turning 2FA off first, he cannot get in by himself, and it has to come in as a support case.

Typical questions from the customer

"What is 2FA, and should I use it?"

2FA means two-factor sign-in, that is, on top of the password a code from an app on the phone is required. It is recommended, because there is customer data in the app, and a password alone is easier to steal.

"I can't scan the QR code, because I'm on my phone"

Use Copy code under the QR code and paste the key manually into the authenticator app. The customer then types in the 6-digit code and presses Enable 2FA.

"I've changed phone and can't sign in"

If the customer can still get in on the old device, he should turn 2FA off and set it up again on the new one. If he cannot get in, there is no button that helps, and it has to come in as a support case.

"Where do I find your privacy policy?"

Lowest down on the tab, under PRIVACY. For a customer at an agency it is the agency's own policy that is shown.

Limitations and errors

The tab can do only two things: two-factor sign-in and links to the documents. There is no password change, no data export (that sits under the account), no deletion of data and no overview of who has been signed in. Two-factor sign-in applies only to the user who turns it on, and cannot be required for the whole company from here.

Error messages: "Could not start the two-factor sign-in. Please try again.", "Invalid code. Try again.", "Could not verify code" and "Could not turn the two-factor sign-in off". In every case the state is unchanged, so the customer can try again. If a setup is broken off halfway, 2FA is not turned on, and the customer signs in as before.