Security — Two-Factor Authentication & Active Sessions

Opening the Security screen

To open the Security settings:

1. Open the side drawer by tapping ☰.
2. Tap your profile card at the bottom of the drawer to open your Profile.
3. On the Profile screen, tap the Security row ("Two-factor authentication and active sessions").

The Security screen shows the status of each two-factor authentication (2FA) method, your backup codes options, and a row that opens the Active sessions screen.

What is two-factor authentication

Two-factor authentication (2FA) adds a second layer of security to your account. After entering your password, you are also asked for a temporary code from a second source — either an authenticator app or your email.

This means that even if someone discovers your password, they cannot sign in without also having access to your phone or email.

CX Assistant supports two 2FA methods:

• Authenticator app (TOTP): A time-based 6-digit code from apps like Google Authenticator, Microsoft Authenticator, or Authy.
• Email OTP: A 6-digit code sent to your registered email each time you sign in.

Set up authenticator app (TOTP)

Step-by-step to enable authenticator app 2FA:

1. On the Security screen, tap Set up Authenticator app.
2. A QR code appears. Open your authenticator app (Google Authenticator, Microsoft Authenticator, Authy, etc.) and scan it.
3. If you cannot scan, copy the secret key shown and enter it manually into your authenticator app.
4. Your authenticator app will now show a 6-digit code that refreshes every 30 seconds.
5. Enter the current 6-digit code in the verification field and confirm.
6. On success, your backup codes are shown. Save them securely — you can share them to a safe place using the share option.

After setup, you will be asked for an authenticator code every time you sign in.

Set up email OTP (one-time password)

Step-by-step to enable email OTP:

1. On the Security screen, tap Set up Email code.
2. We immediately send a 6-digit code to your registered email address.
3. Open your email and find the code (check spam if needed).
4. Enter the 6-digit code in the verification field and confirm.

After setup, you will receive a 6-digit email code every time you sign in.

Backup codes — save and share them securely

Backup codes are shown when you enrol an authenticator app. They are single-use emergency codes that let you sign in if you ever lose access to your phone or authenticator app.

What to do with backup codes:

• Use the share button to send them to a safe place via your device's share sheet — for example a password manager or a secure note app.
• Do NOT store them on the same device as your authenticator app.
• Each code can only be used once — it is invalidated immediately after use.

If you have used most of your codes or lost them, regenerate a fresh set from the Security screen while signed in.

Regenerate backup codes

If you have used most of your backup codes or want a fresh set:

1. On the Security screen, tap Regenerate backup codes.
2. You will be asked to enter a 6-digit code from your authenticator app to confirm it is you.
3. Enter the code and confirm.
4. A new set of backup codes appears — the old codes are immediately invalidated.
5. Save the new codes securely (you can share them to a safe place via the share sheet).

Regenerating requires the authenticator app (TOTP) method to be enabled on your account.

Disable authenticator app

To turn off authenticator app 2FA:

1. On the Security screen, tap Disable Authenticator app.
2. A sheet appears asking for your account password — disabling any 2FA method always requires your password.
3. Enter your password and tap Disable.

After disabling, authenticator-based 2FA will no longer be required at sign-in. If you also have email OTP enabled, that still applies.

We recommend keeping at least one 2FA method enabled at all times.

Disable email OTP

To turn off email OTP 2FA:

1. On the Security screen, tap Disable Email code.
2. A sheet appears asking for your account password — disabling any 2FA method always requires your password.
3. Enter your password and tap Disable.

After disabling, you will no longer receive a code by email at sign-in.

Two-factor authentication status

The Security screen clearly shows the current status of each 2FA method:

• Enabled: the method is active and will be offered at sign-in.
• Not enabled: the method is inactive.

You can have both the authenticator app and email OTP enabled at the same time. At sign-in, the verification screen shows a tab for each enabled method (plus Backup code) and you choose which to use.

Active sessions — see where you are signed in

The Active sessions screen shows every device or session currently signed in to your account — one row per session.

Each row shows:

• A friendly device name or type (e.g. iPhone, Android device, Mac).
• The sign-in location or IP address.
• How recently that device was active (relative time).

Your current device is highlighted so you can tell it apart. Review this list regularly — if you see a device you do not recognize, revoke it immediately and change your password.

Opening the Active sessions screen

To view your active sessions:

1. Open your Profile (drawer → profile card at the bottom) and tap Security.
2. On the Security screen, tap the Active sessions row.

The screen loads the current list of signed-in sessions from the server. Pull down and release to refresh it at any time.

Sign out a single device (revoke session)

To sign out one specific device:

1. Find the session row in the Active sessions list.
2. Tap the sign-out control on that row.
3. Confirm in the dialog — that device will need to sign in again.

The session is revoked immediately. The next time that device tries to use the app, it is redirected to the sign-in screen.

Sign out all other devices

To sign out every device except the one you are currently using:

1. On the Active sessions screen, tap Sign out other devices.
2. Confirm in the dialog.

Your current device remains signed in; all other sessions are revoked. Use this if you think your account has been accessed without your permission.

Unrecognized session — what to do

If you see a session from a device or location you do not recognize:

1. Revoke that session immediately from the Active sessions screen.
2. Change your password (Profile → Change password).
3. Enable two-factor authentication if you have not already.
4. If you still believe your account is compromised, contact support (Profile → Support).

Security best practices

• Enable at least one 2FA method for your account.
• Use a unique, strong password (do not reuse passwords from other services).
• Review your active sessions periodically and revoke devices you no longer use.
• Save your backup codes somewhere safe, off this device.
• If your phone is lost or stolen, sign in from another device and revoke all other sessions.