Keeping your account secure

Your password

Passwords must be at least 12 characters. To change yours:

1. Click your name and open Your account.
2. Under Password, enter your Current password, your New password and type it again.
3. Click Change password.

Changing your password signs you out on your other devices; this one stays signed in.

Require two-factor sign-in for everyone

Two-factor sign-in means a stolen password isn't enough to get in. Owners can require it for the whole team:

1. Set up two-factor sign-in for yourself first, on Your account.
2. Go to Settings → Security and data.
3. Under Sign-in, tick Require two-factor sign-in for everyone and click Require it.

People who haven't set it up are asked to at their next sign-in, before they can do anything else. When it isn't required, Settings shows a tip suggesting it. See Two-factor sign-in.

Signed-in devices

Your account → Signed-in devices lists everywhere you're signed in, with the address and when each was last active.

• Don't recognise one? Click Sign out next to it, then change your password. It's signed out straight away.
• Sign out all other devices keeps only the one you're using.

Built-in protection

• After 5 wrong passwords, an account is locked for 15 minutes.
• Too many attempts from one connection are paused with “Too many attempts. Try again in a few minutes.”
• Password-reset links work once, for one hour, and a password reset never skips two-factor.
• Integration secrets, such as your WhatsApp token and AI keys, are stored encrypted and never shown again.

See who did what

The audit log records every change, by people, Duke (with who approved it) and automations, and nobody can edit it.