Account security

Open Settings, then Security. Everything here happens on RecruitAffiliates.ai. You never have to visit another site, and every email about these changes comes from RecruitAffiliates.ai.

Change your password

1. Type your Current password.
2. Type a New password of at least 10 characters, then type it again in Confirm new password.
3. Press Change password.

Every other browser is signed out at once, and you get an email to say the password changed. If that email isn't from you changing it, use Forgot your password? on the sign-in page and then write to support.

You get ten tries at your current password, then a short wait. A right answer clears the count.

Change your email

1. Type the New email.
2. Type Your current password. This stops someone using your open laptop from moving your account to their inbox.
3. Press Send confirmation link.

We send a link to the new address. Nothing changes until you open it. The link works once and stops working after 60 minutes. When you open it, you sign in with the new address from then on, and we email the old address to say so.

Two things cancel a pending link. Changing your password does, so a link that was sent before you locked out a stranger can't finish the job. And a link nobody opens within the hour just expires.

Two-factor

Two-factor is a second check after your password: a six digit code from an app on your phone, such as Google Authenticator or 1Password. A stolen password alone can't sign anyone in.

1. Press Turn on two-factor and type your password.
2. Scan the QR code with your authenticator app. If you can't scan, type the secret under it into the app.
3. Save your backup codes. Each one works once, for the day you lose your phone. They're shown once.
4. Type the six digits from the app and press Turn it on.

From then on, RecruitAffiliates.ai asks for a code after your password. Use New backup codes to replace the set, and Turn two-factor off to remove it. Both ask for your password and a current code.

Your account is one account. If you also use AffiliateRail, two-factor you set up here covers it too, and the other way round.

Four things send an email to your account's address: turning two-factor on, turning it off, replacing backup codes, and using one. Each email has one button that opens this tab. If it wasn't you, change your password and sign out everywhere else, then write to support.

Lost your phone and your backup codes?

You can still get back in. On the two-factor screen, press Recover your account. Recovery doesn't trust your email, because whoever has your phone may have your inbox too. It asks for three things instead:

1. Your password. You type it at every step.
2. A DNS record on your brand's domain. We show you a TXT record that starts recruitaffiliates-recovery=. Add it wherever you bought the domain, then press I have published it. A TXT record is a line of text you publish on your domain, and only its owner can add one.
3. A 72-hour wait. We email your account when the recovery starts and when the wait begins. If it wasn't you, one press cancels it, from the email or from the warning on your Security tab.

After the wait, come back to the same page and press Remove two-factor. You're signed in, and we email you to say two-factor is off. Set it up again on your new phone straight away.

No brand domain on file? Write to support from an address at your company's own domain. The same wait applies.

Where you're signed in

The list shows every browser with a live sign-in, a rough place from the network, and when it was last used. The place is a guess, so don't worry if the city is a little off. Press Sign this one out beside a browser to end just that one. Press Sign out everywhere else to end all of them except the one you're on. Neither sends an email, because you just pressed the button.

Recent sign-ins and changes

This list shows what has happened to your account, newest first, with the device and a rough place beside each line. It covers sign-ins, failed attempts, password changes and resets, email changes, and every change to two-factor.

An email change shows up twice. "Email change requested" is when you asked, and "Email changed" is when someone opened the link. If you see the first and never the second, the link wasn't used.

A reset from Forgot your password? shows as "Password reset", with the sign-in that follows it just above.

Sign-in and security emails

When you sign in from a browser or device you haven't used before, we email you: "New sign-in to your RecruitAffiliates.ai account". If it was you, ignore it. If it wasn't, change your password and sign out everywhere else. Your first sign-in on a new account doesn't send one.

These emails are never switched off by an unsubscribe. They're about your account's safety, not marketing.