Password rules
A password must be at least 12 characters with upper and lower case, a number and a symbol, and is checked against known breach lists before it is accepted. Sign-in attempts are limited to five a minute per account.
Two-factor authentication
- Open Settings → Security. You are asked for your password first.
- Press Enable, scan the QR code with an authenticator app, and enter the code it shows to confirm. Two-factor is not on until the code is confirmed.
- Save the recovery codes somewhere safe. Each one signs you in once if you lose the authenticator.
If your agency requires two-factor, the Security page says so and, after the grace period, is the only page you can open until it is on.
Signing in through iUtils
If you sign in with your iUtils account, your password and two-factor live on the hub and the Security page shows whether two-factor was on at your last sign-in. Turn it on at iUtils and it protects every iUtils app. Signing out of the hub signs you out here as well.
Sessions
A session ends after 120 minutes of inactivity. Sign-ins, failed sign-ins and two-factor changes are recorded in the audit log, which agency owners and admins can read.