Login security

TrackCrown protects sign-in with rate limits and a lockout, optional or enforced two-factor authentication (TOTP), single-use recovery codes, optional single sign-on, and alerts when an account signs in from a new device.

Two-factor authentication (2FA)#

Any user — staff, partner or advertiser — can turn on 2FA in their profile (Profile in the network panel and the portals, My account for platform admins):

1. Under Two-factor authentication start the setup.
2. Set up two-factor authentication: scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy…) or use "Can't scan? Enter this key manually".
3. Enter the 6-digit code and confirm. The card shows On.

From then on, sign-in asks for a code after the password. To turn it off, confirm with your Password and a current 6-digit code.

Recovery codes#

Once 2FA is on, the Recovery codes card lets you generate 10 one-time codes such as k3m9p-x7q2a:

• They are shown only once ("Save your recovery codes — They are shown only now. Each code works once.").
• Enter one instead of the 6-digit code when you lose your authenticator. Each works once.
• Generate new codes makes every earlier code stop working immediately.
• The card warns Running low at 3 or fewer and None when all are used.

Codes are stored as argon2id hashes and removed when an account is anonymised.

Require 2FA for staff#

Settings → Workspace → Security → Require two-factor authentication for staff (admins and owners). It applies to owners, admins, managers and analysts; partners and advertisers keep 2FA optional.

• When the setting has never been saved, it is on in production and off in development installs.
• A staff member without 2FA is sent to their profile ("Two-factor authentication is required") and cannot use staff actions until they enable it.

Platform administrators have their own switch: Admin → My account → Require two-factor authentication for platform administrators (same default).

Single sign-on (SSO)#

Platform admins configure OpenID Connect providers per brand under Admin → Single sign-on — Google, Microsoft or another OpenID provider. Users then see SSO buttons on the sign-in page.

• SSO signs in existing accounts by verified e-mail address; it never creates accounts.
• Users with 2FA still enter their code after SSO.
• A workspace can require it: Settings → Workspace → Single sign-on → Require single sign-on for members. Password sign-in is then refused for that workspace's members; platform administrators keep password sign-in as a fallback.

Rate limits and lockout#

Lockout: 5 failed sign-ins (wrong password or wrong 2FA code) in a row within 10 minutes lock the e-mail address for 10 minutes from the last failure:

• Unknown e-mail addresses are locked exactly like real ones, so the message never reveals whether an account exists.
• The owner of a real account receives an e-mail "Your <brand> account was locked".
• A successful sign-in or an admin unlock resets the count.

Password reset links are valid for 1 hour; invitation links for 7 days.

Unlock an account and review sign-ins#

Platform admins open Admin → Sign-ins (/admin/logins): sign-in attempts across every brand and workspace, filterable by Event — Signed in, Failed password, Wrong 2FA code, Locked, Unlocked — and searchable. Unlock a locked account there once the owner is verified.

New-device alerts#

When a user signs in successfully with a device — "<browser> on <OS>", plus the country when known — that the account has not used in the last 90 days, and the account has signed in before, the sign-in is flagged as new-device in the sign-in history and the user gets one alert:

• the in-app notification "New sign-in to your account" (linking to their profile's sign-in history), and
• the security e-mail "New sign-in to your <brand> account" with a Review sign-ins button (when e-mail is configured).

Both are on by default. Each user chooses how they receive them under Automation → My notifications → New-device sign-ins (in-app, e-mail, both or neither). Platform administrators without a workspace get the e-mail only.

Sign-in history and sessions#

On the profile page:

• Sign-in history — "Your last sign-ins and failed attempts" with Time, Result (Signed in, Wrong password, Wrong 2FA code, Locked, Unlocked by admin), Method, Device and Country.
• Active sessions (every profile page, including the portals and the admin My account page) — every signed-in browser with This device marked; Sign out one session or Sign out other sessions.

Sign-in events store a keyed hash of the IP address and of its network, not the address itself.

Checklist for a new workspace#

1. Make sure Require two-factor authentication for staff is on.
2. Ask every staff member to save their recovery codes.
3. If your company uses Google Workspace or Microsoft Entra ID, ask the platform admin to set up SSO and consider Require single sign-on for members.
4. Give people the lowest role that fits (see Security overview).

Related#

• Audit log
• Security overview