Turn on two-step verification

Protect your ISMS Copilot account with a code from an authenticator app at sign-in. Optional for every account, with ten single-use recovery codes.

Two-step verification adds a second step when you sign in: after your password (or Google or Microsoft sign-in), you enter a 6-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password.

It is optional and available on every plan, including Free. It is a personal setting: each person turns it on for their own account.

Turn it on

Open Settings and select Account.
Under Two-step verification, click Turn on two-step verification.
Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown under the code by hand.
Enter the 6-digit code the app shows and click Verify.
Save your recovery codes (see below), then click I have saved my codes.

When it is on, Settings shows Two-step verification is on and how many unused recovery codes you have left. Your other signed-in browsers are signed out and ask for the code the next time you sign in.

Save your recovery codes

When you turn it on, ISMS Copilot shows ten recovery codes. Each code works once and lets you sign in if you lose your phone.

Use Copy or Download to keep them in a password manager or another safe place.
You will not see them again after you leave that screen.

To get a fresh set, click New recovery codes in Settings → Account. Your old codes stop working as soon as the new ones are created.

Sign in as usual.
On the Two-step verification screen, enter the 6-digit code from your authenticator app.
Click Verify.

Until you complete this step, the app does not open. You can also click Sign out on that screen.

If you use heyGRC or Aevral with the same account, they ask for the code too.

If you lose your phone

On the Two-step verification screen, click Use a recovery code.
Enter one of your saved recovery codes and click Verify.

Using a recovery code turns two-step verification off for your account, and all your other recovery codes stop working. This lets you sign in and set it up again with a new phone. Go to Settings → Account and turn it back on right away.

After 5 wrong recovery codes in 15 minutes, you have to wait before trying again. Wrong authenticator codes are also rate limited: if you see Too many attempts, wait a few minutes.

Turn it off

Open Settings → Account.
Under Two-step verification, click Turn off.
Confirm.

Your account is then protected by your password only, and your recovery codes stop working.

API keys and AI app connections

Two-step verification protects sign-in to the apps. Credentials that are not a sign-in work differently:

Access tokens and AI app connections (MCP) in Settings → Connected apps, and model API keys from the platform console, that you created before turning on two-step verification keep working.
New ones can only be created after you complete the second step.

If you want every credential to be created behind two-step verification, revoke the old ones and create new ones after you turn it on. See Tokens and scopes.

Good to know

Only authenticator apps (time-based codes) are supported. SMS codes and hardware security keys are not.
If you sign in with Google or Microsoft, you can also turn on two-step verification in that account. Both work together.
For other account security tips, see How to secure your ISMS Copilot account.