Your identity, your password, and the protection of your account.
What it is for
Your account gives access to prospects' contact details, personal data you are responsible for. This page is what stops someone else getting in as you.
How to use it
- Two-factor authentication is the only setting that really matters here. A stolen password is then no longer enough to get in.
- The methods are not equal, and they rank by phishing resistance. A passkey (fingerprint, face or device code) and a security key (the small one you plug in) are the only two genuinely resistant ones: their signature is bound to the domain, so a spoofed page gets nothing usable. An authenticator app comes next: its code expires, but a real-time phishing kit relays it within the second. There is no fourth route: an emailed code is no longer offered for enrolment, and SMS never was, a number being takeable over at the carrier.
- Backup codes belong somewhere other than your browser. They are for the day you lose your phone: in your password manager, or on paper.
- Your connected devices are listed elsewhere, on the Security screen, under "Connected devices". One you do not recognise signs out with a click.
Step by step: securing your account in three minutes
- Open the Security section of your profile.
- Add a passkey if your device supports it. Your phone or computer will ask for your fingerprint or face: nothing leaves the device.
- Add an authenticator app as a second method. A single method is a single point of failure: a lost phone locks you out.
- Download the backup codes and store them outside the browser.
- Go to the Security screen and sign out unknown devices, under "Connected devices". If you recognise none of them, change your password before signing anything out.