Account and Security

Users can change their password from account settings when signed in. If they cannot sign in, they can use the password reset flow where available.

• Choose a password that is difficult to guess.
• Do not share passwords with other users.
• If a password may be exposed, change it immediately.

Two-step verification adds one check after a successful password sign-in. Email codes and approval from another signed-in device can be enabled separately or used together.

• Email verification requires a verified contact email.
• Device verification requires at least one trusted browser or device.
• If both options are enabled, choose either one when signing in.
• Google sign-in does not show an additional EduVerse verification step because Google has already authenticated the linked account.
• An organization admin with device-only verification can use the verified organization contact email as a recovery option without enabling email codes for everyday sign-ins.

1. 1Choose Send a code by email.
2. 2Open the inbox shown on the verification screen.
3. 3Enter the six-digit code within 10 minutes.
4. 4Choose Verify and sign in. The successful browser becomes trusted.

You can approve from any phone, tablet, or computer where you are already signed in to the same EduVerse account and that browser or device is trusted.

1. 1Open EduVerse on another device where this account is already signed in.
2. 2Open the sign-in approval notification and choose Approve sign-in.
3. 3If the notification is not visible, open your profile or Settings, go to Security, then Devices & sessions, and approve the waiting sign-in.
4. 4Return to the new device. Its sign-in screen continues automatically.

Open Settings > Security > Verification & recovery to manage recovery email and two-step verification. Security uses the same hover or chevron sub-tab menu as Finance: Sign-in methods contains password and Google sign-in; Devices & sessions contains browser access, active sessions, and local chat recovery. The verified contact email is used for email sign-in codes and other security communication. It can differ from the email used as the account name.

• Organization admins use the verified organization contact email shown in Settings > Profile.
• Other users can add and verify a personal contact email from Settings > Security.
• A user with a linked Google account can choose its verified Google email as the contact email.

1. 1Choose Change contact email beside the current address. EduVerse sends a six-digit code to that address.
2. 2Enter that code to unlock the email field. The field stays unlocked only in this signed-in session and for up to 15 minutes.
3. 3Enter and save the new address.
4. 4Open the new inbox and enter the new verification code. Until this is done, the new address cannot receive email sign-in codes.

If you cannot use your email code or any trusted device, an organization administrator may be able to remove the extra sign-in check for your account. This does not reveal your password or sign the administrator into your account.

An org admin who normally approves sign-ins from another device can use the verified organization contact email if those devices are unavailable. The sign-in screen labels this as the organization recovery email.

1. 1On the sign-in check, choose Use organization recovery email.
2. 2Open the organization contact inbox and enter the six-digit code.
3. 3Complete sign-in. The email remains a recovery choice; email codes are not automatically turned on for every future sign-in.

Linking Google adds another sign-in method. The linked Google email is shown in Security, can be unlinked there, and can be adopted as the contact email when the user chooses it.

A session means the account is signed in. Browser trust means that browser can approve sign-ins and use protected Chat and Mail. These controls are separate.

• Sign out ends the selected session but does not automatically remove browser trust.
• Remove trust stops that browser from approving sign-ins or opening new protected content but may leave its session signed in.
• Sign out all other sessions keeps only the session currently in use.

Signing in and trusting a browser are separate steps. New browsers need approval for secure Chat and Mail by default, including the first browser. Approve from an existing trusted browser or request a six-digit code at your verified recovery email. Organization admins use the organization contact email; other accounts use their own verified contact email.

• Request the code in the browser trust prompt and enter it in that same signed-in browser. The code expires after 10 minutes; wait one minute before requesting another. Five incorrect attempts invalidate the challenge.
• Browser approval codes cannot be used as sign-in or contact-email-change codes. Signing out, changing the recovery email, replacing the browser keys, or removing trust can invalidate an outstanding approval.
• Approval enables future messages. An existing trusted browser must share available recent Chat history; email approval cannot recover old private keys or messages when every copy of the keys has been lost.
• If no trusted browser or verified recovery email is available, Security offers a password-confirmed secure messaging reset. Read its confirmation carefully: old encrypted history cannot be recovered through this reset.

Automatic browser trust is off by default. You can enable it from an already trusted browser in Security. When enabled, a new browser matching an active signed-in session can be trusted without a separate messaging approval. The sign-in two-step verification check still applies.

Login email alerts and login push alerts can be switched on or off independently. They cover new-device and new-location sign-in activity. Security emails and approval notifications include the request time in UTC, browser, operating system, device when available, approximate country, and IP address. Missing information is shown as Unknown. Country is estimated from the network address and may reflect a VPN; it is not proof of identity.