Account security

Profile brings together your two-factor authentication status and active devices. Use it to protect sign-in and end sessions you no longer need.

Enable MFA

MFA adds a one-time code from an authenticator app to your password. Once enabled, a new sign-in requires both factors.

1. Open Profile.
2. In Account security, select Set up MFA.
3. Add the displayed secret to a new ClodDoc entry in your authenticator app. You can use the copy button to copy the secret.
4. Enter a current code in Code from app.
5. Select Confirm MFA.
6. Check for MFA enabled and the enabled two-factor authentication status in your profile.

Caution

An authenticator secret can generate sign-in codes. Protect it like a password: do not post it in a shared chat or store it in files available to colleagues.

Organization administrators normally set up MFA on first sign-in. For the first administrator of a new company, it is part of workspace onboarding. Employees of an active company can enable protection from their profile.

If confirmation is followed by MFA enabled on the server, select Refresh profile. Protection is already enabled, but the interface has not received the latest state. You do not need to create another secret.

Review active devices

Active devices lists sign-in sessions, device types, and their last activity. The current session is marked This device.

1. Compare the list with the devices you use.
2. For an unfamiliar or unnecessary session, select its end-session button with the trash icon.
3. Wait for confirmation. Ending the current session returns you to the sign-in page.

For a normal sign-out on the current device, select Sign out in the profile header. Ending one session does not automatically end every other session.

If something goes wrong

Situation	What to do
A code is rejected	Use a fresh code from your ClodDoc entry. Check automatic time synchronization on your device.
MFA is already enabled	Refresh your profile and check the current status.
The device list cannot be loaded	Select Retry. An empty loading or error state does not prove there are no sessions.
A session could not be ended	Select Retry ending session and wait for the response.
You lost your authenticator or password	Contact your company administrator.

The current interface does not provide self-service MFA reset, recovery codes, or email password recovery. Do not remove the ClodDoc entry from your authenticator before arranging a way to restore access.

Changes to employee access

A company administrator can end an employee’s session from Users. Role changes also revoke active sessions. Being signed out after an agreed role change can therefore be expected behavior.

Related guides

• Invitations and first sign-in
• Roles and permissions
• Manage your team