Skip to content
RevoDocs

Account security and MFA

Two-factor authentication, recovery codes, passwords, sessions and email verification for your Revo account.

Updated

On this page

Your Revo account can see security data about every customer you manage, so protect it like an administrator account.

Two-factor authentication

Revo uses time-based one-time codes (TOTP) from an authenticator app.

  1. Open Settings → Account security.
  2. Scan the QR code with your authenticator app (Microsoft Authenticator, Google Authenticator, 1Password and similar) and enter the code it shows.
  3. Save your recovery codes. Each works once, in place of a code, if you lose your phone. They're shown only once.

To turn it off you need your password and a current code.

Two-factor authentication is required for some actions, whatever your role:

  • turning on patch management for a customer;
  • anything your workspace requires it for (below).

Require it for everyone

Owners and admins can turn on Require MFA in Settings → Workspace & branding. Every member then has to enroll an authenticator app before using the platform.

Lost your phone?

Use a recovery code to sign in, then set up two-factor authentication again. If you have no recovery codes left, an admin or owner can reset your MFA in Settings → Team (only an owner can reset another owner's). Resetting is audited.

Passwords

  • Passwords are stored as Argon2id hashes; Revo never stores or shows your password.
  • Change password is in Settings → Account security. Changing it signs out your other sessions.
  • Forgot your password? Use the link on the sign-in page. Resetting signs you out everywhere and keeps two-factor authentication on.
  • Repeated failed sign-ins are throttled, and you and your workspace's administrators are notified about bursts of failures (at most once an hour).

Sessions

Sessions expire after 12 hours, or after 2 hours without activity. They're revoked when you sign out, change your password, or when your role changes or your account is deactivated.

Email verification

If you see a banner asking you to confirm your email, click the link we sent (or Resend). Until you confirm, you can sign in and look around but can't run assessments, generate reports, invite teammates, deploy agents or create API keys.

Good practice for MSP teams