---
title: "Account security | Data Tactical Group"
route: "/docs/account/account-security"
updated: "2026-10-23"
---

# Account security

Sign-in is by email and password, with optional two-factor authentication. Everything on this page is set by each person for their own account, from Your account → Security.

## The short answer

Two-factor authentication with an authenticator app is optional and personal: no plan or organization requires it. One sign-in has one active session, so signing in somewhere new signs the previous session out. A session lasts seven days from its last use and thirty days at most from sign-in. **Sign out everywhere** ends every session of yours, this browser’s included. A forgotten password is reset by a one-hour link sent to your address.

## Two-factor authentication

Turning it on asks for your password, then for a six-digit code from an authenticator app. You are then shown a set of backup codes once and never again; each signs you in once when the device is not to hand. Store them somewhere other than the device. Turning two-factor off, or replacing the backup codes, also asks for your password first. On the sign-in screen, **Trust this browser** skips the second step on that browser.

Repeated wrong codes lock the second factor for a short time. It unlocks by itself; nobody has to reset it.

## Sessions

The app allows one active session per sign-in. If you use two devices, signing in on the second signs the first out; sign in again when you return to it. **Sign out everywhere** ends only your own sessions. It does not sign out other members of your organization.

## When sign-in pauses

Sign-in has no lockout. After ten failed attempts for one address within an hour, sign-in for that address pauses for a time and then works again by itself.

## Resetting a password

Use the password-reset link on the sign-in screen and enter your address. If an account exists for it, a link is sent that works once and lasts one hour. Setting a new password signs out every session of yours, and a confirmation is sent to your address. A reset does not revoke your API keys: the confirmation lists the keys you hold, so you can revoke any that is not yours. A password must be at least ten characters.

## Changing your email address

From Your account → Profile, enter the new address. A link goes to the new address and lasts one hour, and the old address is told that a change was asked for. The old address stays in place until you follow the link; your memberships are unaffected. Data Tactical Group staff do not change an address by hand.

## If you think someone else has signed in

Reset your password, which ends every session, and turn on two-factor authentication. If an API key may have been exposed, revoke it (see [API keys](/docs/account/api-keys) ). Then write to [support@datatactical.group](mailto:support@datatactical.group) so a person can look at it with you.

## Related

Roles and what each can do are on [organizations and members](/docs/account/organizations-and-members). What is in place across the service, and how to report a vulnerability, is on the [security](/legal/security) page.

Still stuck? A person can help.

[Get support](/support)