# Two-factor authentication, required per company

> Everyone can now protect their account with an authenticator app, and company admins can make it mandatory for their team.

Version: v1.598
Date: 2026-09-28
Source: https://doc.checkgrow.com/changelog/v1-598-two-factor-authentication-required-per-company

## What this solves

A password alone is one stolen credential away from your company's data. Security teams, especially in finance and payments, expect a second factor on every account that can see customer or campaign data.

## What changed

- **Two-factor authentication for every account.** In My Account, set up an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. Every sign-in (password, email code or Google) then asks for a 6-digit code.
- **Recovery codes.** You get 10 one-time codes when you set it up. If you lose your phone, one of them gets you back in, and you set up a new authenticator straight away.
- **Required per company.** Company admins can switch on **Require two-factor authentication** for their team, with a grace period of 3, 7 or 14 days or none. During the grace period members see a reminder; after it, they set it up before they can continue. Other companies are not affected.
- **See and reset.** The Team page shows who has two-factor on. Admins can reset a member's two-factor after a lost phone, which also signs them out everywhere.
- **Protected on the server, not only on screen.** A company's data stays out of reach of any sign-in that skipped the second step, including direct requests to our services.
- **Stronger passwords.** New and changed passwords now need at least 12 characters, and changing a password on an older sign-in asks for a code sent by email.

## Where to find it

- My Account → Two-factor authentication.
- Team → Security → Require two-factor authentication (company admins).

## Useful for

Company admins who must meet a security policy, and anyone who wants their account protected beyond a password.