Security and your account#

Everything on this page is per person, not per workspace, and lives in My profile. Changing it affects every workspace you belong to.

Passwords#

• Minimum 8 characters, up to 256. There is no rule about mixing cases, digits or symbols — length is what is enforced, so use a long passphrase or a password manager.
• Passwords are stored only as an argon2 hash. Nobody at Laver can read yours, and support will never ask for it.
• When you change your password, the new one has to be different from the current one.

Failed sign-in lockout#

Repeated wrong passwords lock the account for a rising period:

A successful sign-in clears the count. The first lockout also sends an Account Access Alert email to the address on the account, so you find out if someone else is guessing at it.

Sign-in failures deliberately return the same message — Failure to login. — whether the address is unknown, the password is wrong, or the account is locked out, and they take the same amount of time. This stops the sign-in page being used to work out which addresses have accounts. It also means the message will not tell you which of the three it was; if you are sure the password is right, wait a minute and try again.

Sign-in attempts are additionally rate limited to 10 per minute.

Email verification#

Whether a new sign-up must confirm its email address before signing in is a setting of your deployment. Where it is switched on, signing up sends a verification link and the account cannot be used until the link is clicked; a fresh link can be requested from the verification screen.

Invited people never have to verify separately. The invitation arrived in their own inbox, which already proves the address.

Confirming a change of email address (below) also marks the account verified.

Two-factor authentication#

Whether Laver asks for a second factor at sign-in is a setting of your deployment. Where it is switched off, signing in is password only, and the two-factor endpoints are not reachable at all — you can still enrol an authenticator app from My profile, but nothing will ask you for a code. Check your own sign-in screen: if signing in takes you straight to the dashboard after your password, the second step is off.

Where it is switched on, there are two methods.

Emailed code#

The default for a verified account with no authenticator app set up. After your password is accepted, a six-character code is emailed to you and you enter it to finish signing in. Codes are valid for 30 minutes, and wrong codes escalate through the same lockout ladder as passwords.

Authenticator app (TOTP)#

Stronger, and the one to prefer. Set it up from My profile → Two-factor authentication:

1. Scan the QR code with your authenticator app, or copy the secret into it.
2. Enter the six-digit code the app shows to prove it works.
3. Save the eight backup codes you are then given.

Once enrolled, sign-in asks for the code from your app instead of emailing you one.

Backup codes#

You get eight backup codes when you enrol, shown exactly once, with buttons to copy or download them. Keep them somewhere you can reach without your phone.

Each code works once. Redeeming one signs you in and consumes only that code — your authenticator app stays enabled and the remaining codes stay valid. There is no way to view them again, and no self-service way to reissue a set; if you run out or lose them, contact support.

Reset a forgotten password#

From the sign-in page, choose Forgot password and enter your address. If there is an account, a reset link is emailed to it.

• The response is always the same whether or not an account exists — again, so the page cannot be used to enumerate addresses.
• The link is valid for 30 minutes and works once.
• Completing the reset signs out every device. A forgotten password is exactly the case where the old credential may be in somebody else's hands, so nothing that was signed in under it stays signed in.

Change your password#

My profile → Change password. You need your current password.

Every other signed-in device is signed out immediately; the device you made the change on stays signed in. A security alert email goes to the address on the account saying so.

Change your email address#

My profile → Change email address. You need your password.

1. Enter the new address. A confirmation link is emailed to the new address, valid for 30 minutes.
2. An alert goes to your old address telling it a change was requested. Nothing has changed yet.
3. Clicking the link in the new inbox completes the change, marks the account verified, and signs out every other device.

If the new address already belongs to another account, the request appears to succeed but no confirmation email arrives, and the address does not change. That is deliberate: a signed-in user should not be able to test which addresses have accounts.

Log out everywhere#

My profile → Sessions and data → Log out everywhere ends every session for your account on every device, including the one you are using. Use it if you have signed in on a machine you no longer control.

Sessions also end automatically when you reset your password, change your email address, are deactivated or removed from a workspace, or delete your account.

How sessions work#

A session lasts 14 days and is extended each time you use the app, up to a hard ceiling of 60 days from when it was issued. After that you sign in again however active you have been — a stolen token cannot be kept alive forever by using it.

There is no per-device session list. Signing out is either this device (sign out) or all of them (log out everywhere).

API keys are not sessions#

Logging out everywhere does not revoke your API keys, and neither does changing your password. Keys are revoked individually, or by deactivating the person they belong to. If you believe your account was compromised, review and revoke your keys as a separate step — see API keys.

Security alert emails#

Laver emails the address on your account when the password is changed, when an email change is requested and when it completes, when the account is locked out after failed sign-ins, and when the account is deleted. Alerts are sent to the address that was on the account before the change, so a change you did not make still reaches you.

If one of these arrives unexpectedly: reset your password, log out everywhere, then review your API keys.