# Two-Factor Authentication

Add a second sign-in step to your Sistava account using any TOTP authenticator app, like Google Authenticator or Authy. Once enabled, a code from your app is required in addition to your password, so a leaked or guessed password alone is not enough to get in. Turning it on immediately signs out every other active session, so a session created before you enabled it cannot be used to bypass it.

Two-factor authentication adds a second proof of identity to your Sistava account: something you know (your password) plus something you have (a code from an authenticator app on your phone). Set it up once from Profile, and every future sign-in asks for both.

Setup takes under a minute. Sistava generates a unique secret and shows it as a QR code. Scan it with an authenticator app such as Google Authenticator, Authy, or 1Password, then enter the six-digit code the app produces to confirm the pairing. From that point on, sign-in asks for your password first, then the current code from your app.

The part that actually matters for security, not just the extra prompt: enabling two-factor authentication immediately signs out every other browser and device that was already logged into your account, and invalidates their access tokens. Many 2FA implementations only protect the next login, leaving old sessions valid for weeks. Sistava closes that gap the moment you turn it on, so a stolen cookie or an old logged-in laptop cannot keep working around the new protection. The device you just used to enable it stays signed in.

Two-factor authentication protects your personal account, not a single workspace. If you belong to more than one Sistava workspace, the same authenticator code covers sign-in across all of them, since they share one login.

Turning it off is as direct as turning it on, provided you are signed in. The same Profile screen has a control to disable it, and once you do, sign-in goes back to email and password alone. The situation worth planning for is the other one: if you lose the device holding your authenticator app while signed out, there is no self-service recovery code today, so keep the app backed up or set it up on a second device you control.

A second factor is only useful if it cannot be brute-forced, so wrong codes are limited per account as well as per network address. A six-digit code refreshed every thirty seconds would otherwise be guessable by anyone patient enough to rotate through addresses, and the per-account limit is what closes that. A correct code clears the counter, so an honest mistyped code costs you nothing.

Be clear about what it does and does not cover, because security claims are worth less when they are vague. Two-factor authentication protects the act of signing in to your account. It is a personal setting, so each person turns it on for their own account and there is no workspace-wide switch that forces every collaborator to enable it. It is also separate from the approval cards that hold an employee's risky actions, which apply whether or not you use a second factor.

## Turning It On

Open Profile from the top-right avatar menu, then Two-factor Authentication. Scan the QR code with an authenticator app and enter the current six-digit code to confirm. There is no separate approval step: the correct code is what activates protection.

Because activating it signs out every other session, do this from a device you trust and keep nearby, since it is the one session that stays logged in while everything else is forced to sign in again with the new second step.

## Signing In Afterward

Every sign-in first checks your email and password as usual. If two-factor authentication is on, Sistava then asks for the current code from your authenticator app before it issues a session. The check accepts a short window around the current 30-second code to tolerate small clock differences between your phone and the server, but rejects anything older or invalid.

If you lose access to your authenticator app, you cannot complete this second step from a new device without it. There is currently no self-service recovery code flow, so losing the app means contacting support to have two-factor authentication disabled on your account so you can sign back in and, if you want, set it up again with a new device.

## Turning It Off, And What It Reaches

While you are signed in, disabling two-factor authentication is one control on the same Profile screen you used to enable it. Sign-in returns to email and password, and nothing else about your account changes. Because there is no self-service recovery code yet, the sensible precaution is a second device or a backed-up authenticator app rather than relying on being able to switch it off after you have already lost access.

One consequence catches people out. Because enabling it invalidates your account's existing access tokens, a desktop companion you had already paired stops being trusted and has to be paired again. That is deliberate, not a fault: a device authorized before the second factor existed should not keep its access afterwards. Pair it again once and it behaves exactly as before.

## How It Works

**A TOTP authenticator app becomes your second sign-in factor**

Sistava uses the standard TOTP (Time-based One-Time Password) protocol, the same one used by most authenticator apps. When you turn it on, the server generates a random secret and gives you a QR code containing it. Your authenticator app scans that code and starts generating a new six-digit code every 30 seconds, derived from the shared secret and the current time.

You confirm setup by entering one of those codes back into Sistava. That single successful check is what flips two-factor authentication on for your account, and at that moment your other active sessions are logged out and your account's access tokens are invalidated, so anything signed in before setup has to sign back in with the new second step. Every subsequent login checks your password, then asks for the current code from your app before granting access; a code from thirty seconds ago or from the wrong secret is rejected.

No SMS or email codes are used, since those can be intercepted or delayed. The code lives entirely on your device, inside the authenticator app, and is never sent to Sistava except at the moment you type it in to sign in.

## Use Cases

### Protecting production workspaces

A workspace where AI employees run real, billable work benefits from a second sign-in factor so a compromised password alone cannot reach live automations, connected tools, or billing.

### Shared or small-team accounts

When more than one person effectively has access to sign-in credentials, two-factor authentication makes sure a leaked password is not enough by itself to get into the account.

### Closing out stale sessions after a security scare

If you suspect an old device or browser is still signed in somewhere you no longer control, enabling two-factor authentication forces every other session to sign in again immediately.

### Meeting a client's security questionnaire

When a customer or an insurer asks how access to the tools handling their data is protected, a standards-based second factor with immediate session invalidation is a clean, specific answer rather than a promise about password policy.

## Comparison

| Before | After |
|---|---|
| Your password is the only thing standing between an attacker and your workspace, your connected inboxes, and your billing details. | A code that changes every thirty seconds on your own phone is required too, so a leaked password on its own gets nowhere. |
| Adding a second factor only guards the next login, so a browser somebody already had signed in stays valid for weeks. | Every other signed-in browser and device is signed out at the moment you enable it, and has to come back through the new step. |
| Codes arrive by text message, where they can be intercepted, delayed, or sent to a number somebody else took over. | The code is generated on your device by an authenticator app and never travels over a network to reach you. |
| Somebody holding your password can sit and try six-digit codes from a rotating set of addresses until one happens to land. | Wrong codes are limited per account as well as per address, so guessing stops long before it gets anywhere. |

## FAQ

### What apps can I use for the authenticator code?

Any standard TOTP authenticator app works, including Google Authenticator, Authy, Microsoft Authenticator, and 1Password. Sistava does not require a specific app; it just needs one that can scan a QR code and produce time-based six-digit codes.

### Does turning on two-factor authentication log me out everywhere?

Yes, except for the device you are using at the exact moment you confirm setup. Every other browser session and access token tied to your account is invalidated immediately, so anyone who was already signed in elsewhere has to sign back in and pass the new second step.

### Does two-factor authentication apply to every workspace I belong to?

Yes. It protects your personal account and sign-in, not a single workspace, so it covers every workspace you are a collaborator or owner in.

### What happens if I lose my phone or authenticator app?

You will not be able to complete sign-in on a new device without the app that generated your codes. Contact support to have two-factor authentication removed from your account so you can sign in again, and set it up on a new device afterward if you want.

### Can I use two-factor authentication if I signed up with Google or Microsoft?

Two-factor authentication is an extra step on top of your Sistava account sign-in. Your original sign-up method (email and password, Google, or Microsoft) is unaffected; the authenticator code is checked in addition to it.

### How do I turn two-factor authentication off again?

While you are signed in, open Profile from the top-right avatar menu and use the control on the Two-factor Authentication section to disable it. Sign-in goes back to email and password only. If you have already lost the authenticator app and cannot sign in, contact support instead.

### Can I require everyone in my workspace to use two-factor authentication?

Not today. Two-factor authentication is a personal account setting, so each collaborator enables it on their own account from their Profile page. There is no workspace-level switch that turns it on for everyone or blocks people who have not enabled it.

### Will turning on two-factor authentication disconnect my paired desktop app?

Yes, and that is intentional. Enabling it invalidates your account's existing access tokens, including the one a paired desktop companion holds, so the desktop app needs pairing again. Pair it once more and it works exactly as it did before.

## Where Two-Factor Authentication fits

Two-Factor Authentication is part of How you run the account itself.

Sign in the way your company already does, decide who can do what, and keep the money side legible. Credits, plans, invoices, referrals, and the controls that decide who reaches which part of the workspace.

- [How you run the account itself](/en/features/account): Your workspace, your money, your people.

## Read the guide

- [Guide: Two-Factor Authentication](/en/guide/account/organization)

## More in Account & Billing

- [Monthly Credits](/en/features/account/monthly_credits): Every paid plan comes with a pool of credits that refills automatically at the start of each billing period. Credits are the single unit that pays for everything your AI employees do: thinking, tool calls, media generation, voice, and meetings. There is nothing to top up manually each month; your allowance is just there again when the new period starts.
- [Lifetime Credits (Free)](/en/features/account/lifetime_credits_free): Pick the Free plan and your workspace gets 2,000 credits in one grant, no card required. Those credits never reset and never expire; you spend them at your own pace across chat, tools, and media generation until they run out. It is a one-time bucket, not a monthly allowance, so it is meant for trying the platform before you commit to a paid plan.
- [Buy Credits](/en/features/account/credit_packs): Add credits to your workspace balance any time, on any plan, without changing your subscription. Pick from three one-time packs, pay by card through Stripe, and the credits land in your balance as soon as the payment clears.
- [Upgrade & Downgrade](/en/features/account/plan_upgrade_downgrade): Move to a bigger plan the moment you need more credits or a higher employee cap, and the change takes effect immediately. Move to a smaller plan when you need less, and it takes effect at the end of your current billing period so you keep what you already paid for. Both happen from Settings, Subscription, no support ticket required.
- [Promo Codes](/en/features/account/promo_codes): Redeem a promotional code for a one-time, lifetime grant of bonus credits on top of your plan's monthly allowance. Enter a code at signup or any time afterward from Settings, Subscription, Get Free Credits. Each grant shows up in your Credit Grants history with its source, date, and amount, and one code can be redeemed once per workspace.
- [Referrals](/en/features/account/referral_program): Share your personal referral link or invite someone by email, and you both get 1,000 free credits the moment they sign up. Track every invite from a dedicated Earn Credits page, and keep earning until you hit the 10-referral cap.
- [Data Retention](/en/features/account/data_retention): Sistava deletes operational data on a fixed schedule instead of keeping it forever by default. A cleanup job runs every day and removes rows past their retention window: short-lived debug data within a week or two, working memory after 30 days of inactivity, and usage and activity history after two years. Chat messages, documents your employees write, and persistent notes are kept indefinitely unless you delete them yourself. There is no setting to change these windows; they apply the same way to every workspace.
- [Google Sign-In](/en/features/account/oauth_google): Sign in to Sistava with your Google account instead of creating a separate password. Choose Sign up with Google on the signup page and your workspace is ready after one approval, with your name and photo carried over automatically from Google. Because Google has already confirmed your email address, there is no verification email to chase before your AI employees can start working.
- [Microsoft Sign-In](/en/features/account/oauth_microsoft): Sign up or sign in with your Microsoft account instead of creating a password. Sistava reads your Microsoft account's name, email, and profile photo to set up your account, and your Profile page shows Microsoft as your connected sign-in method. Because Microsoft has already confirmed the address belongs to you, the account counts as verified from the start and your employees can begin working straight away. Google sign-in and an ordinary email and password are the other two ways in.
- [Workspace Roles](/en/features/account/tenant_roles): Every workspace you create has an Owner, Admin, and Collaborator role, each with a fixed set of permissions over billing, the collaborator roster, and resource access. Owners can grant a non-owner collaborator extra access, or take some away, without changing their overall role. A Roles page shows your own effective access and the full permission matrix so nobody has to guess what they can do.
- [User Profile Picture](/en/features/account/user_profile_avatar): Upload a photo for your account so your teammates and AI employees see a real picture of you instead of initials. It shows up in chat, comments, and the collaborator list across every workspace you belong to. If you signed up with Google or Microsoft, your picture is pulled in automatically the first time you sign in, and you can replace it any time.
- [Feedback Board](/en/features/account/feedback_board): Submit bug reports, feature requests, improvements, and questions from inside the app, then vote on what other users have asked for. Every item lands on one Community Board visible to the whole platform, sorted by vote count, so the most-wanted ideas surface for the team automatically.

## Explore

- [Every feature](/en/features)
- [Hire an AI employee](/en/market)
- [Pricing](/en/pricing)