Signing in safely

This page isn't translated yet; here it is in English.

Two-step sign-in (two-factor authentication)

With two-step sign-in, signing in needs your password and a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy. Someone who steals your password still can't get in.

Administrators must use it. Your company can also require it for everyone, or for certain roles (see Security settings below). If you must use it and haven't set it up, Zanix asks you to set it up right after you sign in.

Set it up

1. Install an authenticator app on your phone.
2. In Zanix, click Set up under Authenticator app. (Or open your profile, top right → Profile.)
3. Scan the QR code with the app, or type the code shown under it.
4. Type the 6-digit code the app shows, and your current password, then click Next.
5. Save the recovery codes (copy or download them) and keep them somewhere safe. Each one works once, if you lose your phone.
6. Click Enable authenticator app.

From now on, after your password, Zanix asks for the code from the app. It changes every 30 seconds.

Lost your phone? Use one of your recovery codes instead of the app code, then set up the app again on your new phone. If you have no codes left, ask an administrator.

Wrong passwords

After 5 wrong passwords, the account is locked for 15 minutes, even if the right password is typed next. This stops people guessing passwords. Wait, or ask an administrator to set a new password for you. Every failed sign-in is recorded in the security log.

At most 2 devices

Each account can be signed in on 2 devices at the same time (for example, a computer and a phone). This stops several people sharing one login.

If you sign in on a third device, Zanix shows the devices you're signed in on. Click Sign out this device on one of them to continue, or Cancel and sign me out.

Where you're signed in

Open your menu (top right) → Where you're signed in to see every device signed in to your account: the browser, when it signed in, when it was last active, and its IP address. Click Sign out next to a device you don't recognise, or Sign out all other devices. If something looks wrong, also change your password.

New device alerts

When your account signs in from a browser it hasn't used before, you get a notification (the bell, top right) with the device and the time. If it wasn't you, change your password and sign that device out.

Signed out after inactivity

If you don't use Zanix for a while, you're signed out automatically, and the sign-in page tells you why. Typing in a form counts as using it, so you won't lose your work while typing. The time is set by your administrator.

Security settings (administrators)

Users and permissions → Security settings:

• Two-factor authentication: required for administrators (recommended), for everyone, or for chosen roles.
• Sign out after this many minutes without activity: between 5 and 1440 minutes.

Changes are recorded in the Security log, together with sign-ins, failed sign-ins, locked accounts, sign-ins from new devices, sign-outs, and devices signed out.