Sign-in security

Open in the demo

Your password and two-factor sign-in, and the tools owners and admins use to keep the organisation safe.

My account

Open it from Settings My account, or from your name at the foot of the menu. Sign out and Help & guide are at the top of the page. It shows your email, role and when you last signed in. Your email can’t be changed here — ask an Owner or Admin to invite your new address.

Change your picture or name

Both are in the first card on My account.

Picture: select your picture (or your initials, if you have none) and choose any image. Pointing at it shows Upload or Replace. Entirova cuts it to a square, shrinks it and compresses it, so even a large photo is stored as a few kilobytes. It shows in the top corner in place of your initials, and beside your name wherever people are listed: System users, your own page, an app's Access page, the audit trail and activity log, journals, approvals and the sign-in tables under Security. It follows you to every organisation you belong to. Remove goes back to your initials.
Name: select Change next to it. It changes straight away in every organisation you belong to. Entries you made earlier keep the name they were made under.
Email: your sign-in email can't be changed. If you need to use a different address, ask an Owner or Admin to remove you and invite the new address; your past work stays in the audit trail under your name.

Change your password

Enter a new password of at least 8 characters, twice. For extra safety Entirova may email you a code to confirm it's you; enter it and select Change password again.

Devices

The Devices card lists every browser and device you're signed in on, with where it signed in from (city and country), its IP address, whether it signed in with a code, and when it signed in and was last active. The one you're using is marked This device. Select a device's name to open a panel with more: the browser and system with their versions, and exactly what the browser reported. Sign out in that panel signs just that device out, within seconds. The copy button beside an IP address copies it. Like every list in Entirova, it has a search box and a filter above it. The location is approximate: it is worked out from the IP address, so a VPN or a mobile network can make it look like somewhere else, and a device that signed in before Entirova recorded sign-ins shows Not known. If you don't recognise a device, sign it out and change your password.

Signed in on a computer you no longer use? Open it in the Devices list and sign it out. This device stays signed in.

Appearance

Settings Appearance sets how Entirova looks for you. Everyone has this page. It changes nothing for anyone else, and a choice applies as soon as you select it.

Setting	Choices	What it does
Colours	Light, Dark, Follow my device	Dark shows light text on dark blue. Follow my device switches with your computer or phone. Documents you print or send, such as invoices and payslips, always stay on white.
Spacing	Comfortable, Compact	Compact fits more rows of a table on the screen.
Text size	Small, Normal, Large	Makes the text and controls on every page smaller or larger.
Menu	Always shown, Hidden until opened	Hidden gives the page the full width. The menu button at the top left does the same thing with one click: it hides the menu and brings it back, and changes this setting to match.
Menu categories	One open at a time, Stay as I leave them	Whether opening one category of the menu closes the others.

Your choices are kept with your login, so they follow you to any browser you sign in on.

Entirova support access

Entirova staff can't see your books. If you contact support and want them to look, an Owner or Admin can turn on access in Settings Security Entirova support access, for 1, 3, 7 or 14 days.

Access is read only, and never includes payroll or employee records.
Every time support looks, it appears in your activity log with their reason.
It ends by itself, or straight away when you select End access now.

Leave an organisation or delete your account

At the bottom of My account, Leave or delete has two buttons.

Leave organisation removes you from the organisation that is open, straight away. Someone there has to invite you again to come back. If you belong to several, switch to the one you want to leave first. The button is greyed out, with the reason beside it, when you can't leave: you're the only owner (make someone else an owner first) or the only person (delete the organisation instead).
Delete my account deletes your login for good and signs you out everywhere. Before anything happens it lists what becomes of each organisation you belong to. You type your email and confirm with your password, and your two-factor code if you use it.
An organisation where you're the only person is deleted with your account, with all its data. You type its name to confirm. Download a backup first if you might need the records.
If you're the only owner of an organisation where other people work, you can't delete your account until you make one of them an owner, so it's never left without one.
Organisations that carry on keep your name on the work you did, in their activity log.

Two-factor authentication

With two-factor on, signing in needs your password and a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password. Someone who learns your password still can't get in.

Turn it on

In My account, select Set up two-factor.
Scan the QR code with your authenticator app. If you can't scan it, type in the key shown under it.
Enter the 6-digit code the app shows and select Turn on two-factor.

From then on, Entirova asks for a code each time you sign in.

Turn off or reset

Once two-factor is on, My account offers two different things:

Button	What it does	Use it when
Turn off	Sign-in stops asking for a code. Your authenticator app stays linked, so Turn on two-factor brings it back with a code from the same app. Nothing to scan.	You want a break from codes but keep the same phone.
Reset	Removes your authenticator app from your login. To use two-factor again you set it up from the start and scan a new code.	You have a new phone, or deleted the app.

Each asks for a code first, so someone who only knows your password can't switch your protection off. If your organisation requires two-factor, Turn off isn't offered; Reset still is, and you're asked to set it up again straight away.

Lost your phone? Ask an Owner or Admin to Reset two-factor in the Security section of your person page. You can then sign in with your password and set it up again.

Require two-factor for everyone

Owners and Admins can make two-factor compulsory in Settings Security, under Sign-in rules.

Set up two-factor for your own account first, then sign out and sign in again with your code.
Switch on Require two-factor for everyone. The card shows how many people already have it on.

Anyone without two-factor is asked to set it up the next time they open Entirova, and can't see or change anything until they do. This is enforced by the server, not only in the app. While it is required, nobody can turn off their own two-factor.

Require it for chosen people

If two-factor isn't required for everyone, you can still require it for particular people, such as accountants or anyone who approves payments. Open the person in Settings System users and select Require two-factor. They must set it up the next time they open Entirova, can't turn it off, and the server enforces it. Stop requiring two-factor makes it optional for them again.

Signing out after inactivity

Under Sign-in rules, Sign people out after inactivity protects computers left unattended. It is 30 minutes unless you choose otherwise (15 minutes to 8 hours, or never). Activity in any Entirova tab keeps the session open.

Invitations expire

Under Sign-in rules, Invitations expire sets how long an invitation stays valid: 1, 3, 7 (the default), 14 or 30 days, or never. After that the person can't join with it and shows as Expired in System users. Open their name and select Resend invitation to renew it from that day. The server enforces this, not only the app.

Coming soon

Passkeys (Face ID, Touch ID or a security key), single sign-on through Microsoft Entra, Google Workspace or Okta, and email alerts when an account is used from a new device or country. They show a Coming soon badge in Sign-in rules until they're ready.

Admin tools

On a person's page in Settings System users, Owners and Admins can:

Send password reset: emails them a link to choose a new password. Their current password keeps working until they do.
Sign out everywhere: ends their sessions on every device within seconds. Use it when a device is lost or a password may be known to someone else.
Reset two-factor: removes their authenticator app and signs them out.

Sign-in belongs to the person's whole account, so signing someone out everywhere, resetting their two-factor or lifting their sign-in lock works only for people who belong to no organisation you don't manage. Anyone else changes these themselves in My account.

Only an Owner can use these on another Owner. Nobody can use them on themselves.

How your data is protected

Passwords are stored encrypted by the sign-in service and never visible to anyone, including us.
Every sign-in goes through Entirova's sign-in service, which applies your blocked IP addresses and countries and records the attempt. Entirova's database only accepts sessions that service has registered, so a session made any other way can't read or change your data.
New accounts confirm their email before they can sign in.
Every save is checked by the server against your role, so the rules can't be bypassed from the browser.
Every change is recorded in the audit trail.

In the demo these controls are shown but switched off, because the demo has no real sign-in.