# Account security Change your RecruitAffiliates.ai password or email, turn on two-factor, see where you're signed in, and sign out everywhere, all from Settings. Open **Settings**, then **Security**. Everything here happens on RecruitAffiliates.ai. You never have to visit another site, and every email about these changes comes from RecruitAffiliates.ai. ## Change your password 1. Type your **Current password**. 2. Type a **New password** of at least 10 characters, then type it again in **Confirm new password**. 3. Press **Change password**. Every other browser is signed out at once, and you get an email to say the password changed. If that email isn't from you changing it, use **Forgot your password?** on the sign-in page and then write to support. You get ten tries at your current password, then a short wait. A right answer clears the count. ## Change your email 1. Type the **New email**. 2. Type **Your current password**. This stops someone using your open laptop from moving your account to their inbox. 3. Press **Send confirmation link**. We send a link to the new address. Nothing changes until you open it. The link works once and stops working after 60 minutes. When you open it, you sign in with the new address from then on, and we email the old address to say so. Two things cancel a pending link. Changing your password does, so a link that was sent before you locked out a stranger can't finish the job. And a link nobody opens within the hour just expires. ## Two-factor **Two-factor** is a second check after your password: a six digit code from an app on your phone, such as Google Authenticator or 1Password. A stolen password alone can't sign anyone in. 1. Press **Turn on two-factor** and type your password. 2. Scan the QR code with your authenticator app. If you can't scan, type the secret under it into the app. 3. Save your **backup codes**. Each one works once, for the day you lose your phone. They're shown once. 4. Type the six digits from the app and press **Turn it on**. From then on, RecruitAffiliates.ai asks for a code after your password. Use **New backup codes** to replace the set, and **Turn two-factor off** to remove it. Both ask for your password and a current code. Your account is one account. If you also use AffiliateRail, two-factor you set up here covers it too, and the other way round. Four things send an email to your account's address: turning two-factor on, turning it off, replacing backup codes, and using one. Each email has one button that opens this tab. If it wasn't you, change your password and sign out everywhere else, then write to support. ## Lost your phone and your backup codes? You can still get back in. On the two-factor screen, press **Recover your account**. Recovery doesn't trust your email, because whoever has your phone may have your inbox too. It asks for three things instead: 1. **Your password.** You type it at every step. 2. **A DNS record on your brand's domain.** We show you a TXT record that starts `recruitaffiliates-recovery=`. Add it wherever you bought the domain, then press **I have published it**. A **TXT record** is a line of text you publish on your domain, and only its owner can add one. 3. **A 72-hour wait.** We email your account when the recovery starts and when the wait begins. If it wasn't you, one press cancels it, from the email or from the warning on your Security tab. After the wait, come back to the same page and press **Remove two-factor**. You're signed in, and we email you to say two-factor is off. Set it up again on your new phone straight away. No brand domain on file? Write to support from an address at your company's own domain. The same wait applies. ## Where you're signed in The list shows every browser with a live sign-in, a rough place from the network, and when it was last used. The place is a guess, so don't worry if the city is a little off. Press **Sign this one out** beside a browser to end just that one. Press **Sign out everywhere else** to end all of them except the one you're on. Neither sends an email, because you just pressed the button. ## Recent sign-ins and changes This list shows what has happened to your account, newest first, with the device and a rough place beside each line. It covers sign-ins, failed attempts, password changes and resets, email changes, and every change to two-factor. An email change shows up twice. "Email change requested" is when you asked, and "Email changed" is when someone opened the link. If you see the first and never the second, the link wasn't used. A reset from **Forgot your password?** shows as "Password reset", with the sign-in that follows it just above. ## Sign-in and security emails When you sign in from a browser or device you haven't used before, we email you: "New sign-in to your RecruitAffiliates.ai account". If it was you, ignore it. If it wasn't, change your password and sign out everywhere else. Your first sign-in on a new account doesn't send one. These emails are never switched off by an unsubscribe. They're about your account's safety, not marketing.