Two-factor authentication, required per company

What this solves

A password alone is one stolen credential away from your company's data. Security teams, especially in finance and payments, expect a second factor on every account that can see customer or campaign data.

What changed

• Two-factor authentication for every account. In My Account, set up an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. Every sign-in (password, email code or Google) then asks for a 6-digit code.
• Recovery codes. You get 10 one-time codes when you set it up. If you lose your phone, one of them gets you back in, and you set up a new authenticator straight away.
• Required per company. Company admins can switch on Require two-factor authentication for their team, with a grace period of 3, 7 or 14 days or none. During the grace period members see a reminder; after it, they set it up before they can continue. Other companies are not affected.
• See and reset. The Team page shows who has two-factor on. Admins can reset a member's two-factor after a lost phone, which also signs them out everywhere.
• Protected on the server, not only on screen. A company's data stays out of reach of any sign-in that skipped the second step, including direct requests to our services.
• Stronger passwords. New and changed passwords now need at least 12 characters, and changing a password on an older sign-in asks for a code sent by email.

Where to find it

• My Account → Two-factor authentication.
• Team → Security → Require two-factor authentication (company admins).

Useful for

Company admins who must meet a security policy, and anyone who wants their account protected beyond a password.