Sign-in security
Copy for AI
Signing in proves two things: that you are who you say you are, and that nobody else is using your password. easySales gives you several ways to prove it. This page explains each one, how they fit together, and which one to reach for in each situation.
How it fits together
Section titled “How it fits together”There are two ways in.
- Password, then a second step. You type your password. If you have turned on two-step verification, easySales then asks for one more proof: a code from your authenticator app, a code sent to your email, or your passkey. A recovery code is the fallback when none of those works.
- A passkey on its own. Select Sign in with a passkey, then use your fingerprint, face or device PIN. A passkey counts as both steps, so there is no password to type.
Without two-step verification, your password alone signs you in.
- Password — something you know. Anyone who learns it can try to sign in as you, which is why a second step helps.
- Two-step verification (often called 2FA) — a second proof after the password, from something only you have: your phone, your mailbox or a device that holds your passkey.
- Authenticator app — an app on your phone that shows a new 6-digit code every 30 seconds.
- Email code — a 6-digit code easySales sends to the email address on your profile. You use either an authenticator app or email codes, not both.
- Recovery code — one of ten spare codes you save when you turn on two-step verification or add your first passkey. Each works once.
- Trusted device — a browser where you ticked Don’t ask again on this device for 30 days. It still asks for your password, but skips the second step.
- Passkey — a key stored on your phone, computer or password manager, unlocked with your fingerprint, face or device PIN. It cannot be typed into a fake website or read out over the phone.
Why several methods
Section titled “Why several methods”Each method covers a different moment. The app works with no signal. Email codes need no extra app. A passkey is the fastest and cannot be phished. Recovery codes are there for the day your phone is lost. Add a passkey as well as your app or email codes, so losing one never locks you out.
| Method | Sign in | Confirm a sensitive action | Connect an AI app | Forgot your password | Lost your phone |
|---|---|---|---|---|---|
| Authenticator app | Yes, after your password | Yes | Yes | Still asked for after the emailed reset | No — it is on the phone |
| Email code | Yes, after your password | Yes | Yes | Still asked for after the emailed reset | Yes, if you can read your email elsewhere |
| Passkey | Yes, on its own or after your password | Yes | Yes | Signs you in without it; reset it with the emailed link | Yes, if the passkey is synced to your new device |
| Recovery code | Yes, when nothing else works | Yes, and it uses up the code | Yes, and it uses up the code | Stands in for the second step after the emailed reset | Yes — this is what it is for |
Yes means the method works in that situation; No means it does not. Each recovery code works once, wherever you use it. Read across a row to see what one method can do.
We don’t use SMS codes
Section titled “We don’t use SMS codes”easySales never sends sign-in codes by text message. A phone number can be moved to another SIM card by someone who talks their way past the mobile operator, and text messages can be intercepted, so an SMS code protects you less than an app, an email code or a passkey. Text messages also cost money for every code sent. Use one of the methods above instead.
Keys and codes
Section titled “Keys and codes”Every key and code, side by side. Read a row to learn everything about one of them.
| Key or code | What it is | How long it lasts | How many you can have | Single-use? | Email when it changes? |
|---|---|---|---|---|---|
| Password | What you type after your email or username | Until you change it; a temporary one from your administrator works for 72 hours | One | No | — |
| Authenticator app code | 6 digits shown in your app | 30 seconds | One app per account | Yes | Yes: when the app is turned on, turned off or removed |
| Email code | 6 digits sent to the email address on your profile | 10 minutes, 5 tries; a new code replaces the earlier one | One app or email codes, not both; a new code once a minute, at most 5 in 15 minutes | Yes | The code is the email; confirming a new address emails the old and the new one |
| Recovery code | One of a set you saved | Until used, or until a new set replaces it | 10 per set | Yes | Yes: a new set, or one used to sign in |
| Passkey | Fingerprint, face or screen lock on your device | Until you remove it | Up to 10 | No | Yes: added, removed, or looks copied; not when renamed |
| Trusted device | A browser that skips the second step | 30 days from when you ticked the box; using it does not extend it | One person per browser | No | Yes: when you tick the box |
| Personal token | A secret an AI tool uses to act as you | 30, 60 or 90 days, as you choose | Up to 10 | No | — |
| AI app connection | An AI app you approved | Until you disconnect it or the app asks you to connect again | Up to 10 | No | — |
| Confirm it’s you | A recent proof, for this sign-in in this browser | 15 minutes | One per sign-in | No | — |
| Calendar link | A private link your calendar app reads; see Calendar | Until you stop it or create a new one | One | No | — |
Legend: Yes / No answer the column’s question; — means easySales sends no email about it.
What ends each one
Section titled “What ends each one”Some events end a key or code for you. Afterwards you set it up again.
| Key or code | You change your password | Emailed password reset | Administrator resets your password | Administrator resets your 2FA | You turn 2FA off |
|---|---|---|---|---|---|
| Password | ✓ | ✓ | ✓ | — | — |
| Authenticator app | — | — | — | ✓ | ✓ |
| Email codes | — | — | — | ✓ | ✓ |
| Recovery codes | — | — | — | ✓ | ✓ |
| Passkeys | — | — | — | ✓ | ✓ |
| Trusted devices | ✓ | ✓ | ✓ | ✓ | ✓ |
| Personal tokens | ✓ | ✓ | ✓ | ✓ | — |
| AI app connections | ✓ | ✓ | ✓ | ✓ | — |
| Calendar link | ✓ | ✓ | ✓ | ✓ | — |
Legend: ✓ = this event ends it; — = it stays as it is.
Turning two-step verification off keeps you signed in, and so does removing your last passkey, which turns it off too. Deactivating an account ends all of them: nobody can sign in to it. Turning on your company’s two-step verification requirement does not end any existing personal token or AI app connection. Email codes also pause when your sign-in email changes, until you confirm the new address — see Use email codes.
Good to know
Section titled “Good to know”- A second step is asked for after the password, never instead of it — except with a passkey.
- A trusted device never skips the password, and it is for one person: when a colleague ticks the box on the same browser, it stops being trusted for you.
- easySales also emails you when someone types your password and then too many wrong codes — at most once a day — and when your administrator resets your two-step verification.
- Your company can make two-step verification optional or required; see Company security settings, which also has the matrix of who can do what.
Common misunderstandings
Section titled “Common misunderstandings”- A passkey is not a password you store. Nothing is typed, and it only works on the real easySales site.
- Recovery codes are not a second password. Each works once, in place of a code or passkey: at sign-in, to confirm it’s you, or to approve an AI app.
- Forgetting your password does not turn off two-step verification. After the emailed reset you still need your second step.
Where to find it
Section titled “Where to find it”Everything that is yours is on My profile, on the Sign-in & security page: Password, Passkeys, Two-step verification with your Trusted devices, and your Calendar subscription. Your company’s rules are in the Two-step verification section under System settings, Users & permissions, for those allowed to change them.
Why it works this way
Section titled “Why it works this way”A password alone is not proof. Passwords are reused, guessed and typed into fake sites. A second step from something only you hold — your phone, your mailbox, your passkey — means a leaked password is not enough to open your customers, quotations and invoices.
Spare ways in keep you working. A phone gets lost on the day a quotation is due. Recovery codes, a second method and an administrator’s reset mean a lost device costs you minutes, not your access, and nobody needs to switch security off to let you back in.
Changes to your second step are announced. easySales emails you when a method is turned on or off, a passkey is added or removed, recovery codes are renewed or used to sign in, or a device is trusted. If you made the change, you delete the email; if you did not, you know at once and can tell your administrator before anything else happens.
Ending a password ends what hangs on it. Changing or resetting a password signs out every device and ends trusted devices, personal tokens, AI app connections and your calendar link, so whoever learned the old password loses everything it opened.
Work faster
Section titled “Work faster”- Sign in with a passkey. Sign in with a passkey replaces the password and the code in one touch; select the passkey from the sign-in box’s suggestions where your browser offers it. See Set up a passkey.
- Trust the computer you use every day. Tick Don’t ask again on this device for 30 days on your own office computer, never on a shared one. See Sign in.
- Add a second method before you need it. A passkey beside your authenticator app or email codes means a lost phone never locks you out. See Get back in.
- Keep the recovery-code count in view. The card shows Recovery codes: N of 10 left; generate a new set at two or fewer. See Use recovery codes.
- Forget a device you no longer use. Trusted devices on Sign-in & security lists each one with its Expires date; Forget or Forget all makes it ask for a code again. See example E on Security examples.
Examples
Section titled “Examples”Six day-by-day stories — a new phone, a company switching the requirement on, one email in two companies, an email address changed by the administrator, a client’s computer and a leaver — are on Security examples.
A trusted device, counted in days. Mei Tan ticks Don’t ask again on this device for 30 days on her office computer on 1 October. The device is trusted until 31 October (1 + 30). Signing in there on 20 October does not move that date. On 31 October she enters a code again and can tick the box once more.
Which events end what. Daniel Lim changes his own password on 14 October. That signs him out on every device, including the one he is using, and ends his trusted devices, his personal token for an AI tool and his calendar link. His authenticator app, recovery codes and passkeys stay as they are, so at his next sign-in he types the new password and a code as before.
Common questions
Section titled “Common questions”- Is two-step verification the same as 2FA? Yes. easySales calls it two-step verification: your password, then a code from an authenticator app or an email, or a passkey.
- Does easySales send sign-in codes by SMS? No. Use an authenticator app, email codes or a passkey. See Use email codes if you have no smartphone.
- Which two-step method should I choose? A passkey is the fastest; an authenticator app works without signal; email codes need no extra app. Add a passkey as well as one of the others.
- Can I use an authenticator app and email codes together? No, one or the other. You can add passkeys beside either.
- Why did I get a security email from easySales? Your sign-in security changed: a method turned on or off, a passkey added or removed, recovery codes used or renewed, a device trusted, or too many wrong codes. If it was not you, change your password and tell your administrator.
- How do I stop easySales asking for a code on my computer? Tick Don’t ask again on this device for 30 days when you enter a code. If your company chose At every sign-in, every sign-in asks for a code and no device is trusted.
- Can my company make two-step verification compulsory? Yes, with Required for everyone and a grace period. See Company security settings.