Account Security
CRM-only users have no billing backend to fall back on, so the workspace carries its own account area. Everything you need to look after your own login lives here, and login challenges and account emails keep you in the interface you started in.
Open it from your initials at the top right of any page.
What you can do
Section titled “What you can do”The page shows a card for each part of your account, with its current state and a link to change it.
| Card | What it covers |
|---|---|
| Password | Change your password. You must enter your current password first. |
| Email address | Change the address on your login. The new address is verified before it takes effect. |
| Authenticator | Set up or replace your two-factor authenticator app. |
| Backup codes | Single-use codes for signing in when you cannot reach your authenticator. The card warns you when you are running low. |
| API key | Create or replace your integration key with API access and the required account/authenticator checks. See Machine access. |
| AI assistants | The assistants connected to your login, with the ability to connect a new one or revoke an existing connection. |
Below the cards sit three links: Request administrator assistance, the Privacy policy, and Log out.
Signing in
Section titled “Signing in”Two-factor authentication works exactly as it does in the billing platform. A remembered browser records which kind of verification it completed, and only an authenticator satisfies authenticator-protected functions.
If a login method is unavailable to you, the sign-in pages say why rather than simply failing, so you know whether to fix your own setup or ask an administrator.
The same protections apply as in the billing platform:
- Failed attempts are limited. After too many wrong passwords or security codes on your account, or from your connection, the sign-in shows a Too Many Requests page for a few minutes. Successful sign-ins never count, and a browser you have remembered is not held back by failures on your account from elsewhere. See Too many failed attempts.
- Codes and reset emails are limited. Sign-in codes and password reset emails to your account are limited to a few an hour.
- New locations are checked. Logging in on a remembered browser from a new location or network asks for a fresh code, and you receive a security alert. Alerts identify your account by its registered email address.
- The privacy policy is asked for once. Ticking the privacy policy at sign-in, or when setting up backup codes or an API key, is recorded, so you are asked again only when the policy is updated.
AI assistants
Section titled “AI assistants”Connecting an assistant through the CRM approves it on the CRM sign-in, so a CRM-only user can connect one without needing backend access. An assistant never gains access you do not already hold, and every write capability stays switched off platform-wide until an administrator enables it.
See Machine access for what an assistant can read and do in the CRM, and AI Assistants for the full connector guidance.
Related pages
Section titled “Related pages”- Accessing the Platform for the platform-wide sign-in and two-factor guidance.
- Access and roles for how an administrator grants CRM access in the first place.