Two-step sign-in and account security

Two-step sign-in means a stolen password alone cannot open your account: signing in also needs a 6-digit code from an authenticator app on your phone. It is optional for lecturers. Administrator accounts must use it.

Set up two-step sign-in

1. Open the account menu at the bottom of the sidebar and choose Profile, then Security.
2. Under Two-step sign-in, choose Set up two-step sign-in.
3. Open an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password.
4. Scan the QR code with the app, or enter the Setup key by hand. Copy key copies it.
5. Enter the 6-digit code the app shows and choose Turn on two-step sign-in.

If the code is refused, you see "That code is not right. Check the time on your phone and try the newest code."

Add a backup authenticator

Once two-step sign-in is on, the button reads Add a backup authenticator. Use it to add the app on a second phone or tablet. When you sign in, a code from any of your authenticators works. DeepMarking has no recovery codes, so a backup authenticator is the way to avoid being locked out.

Signing in with two-step sign-in

After your password, or after Continue with Google, Continue with LinkedIn or Continue with X, you see Enter your code. Open your authenticator app, enter the 6-digit code for DeepMarking and choose Continue.

Turn it off

1. Open Profile, then Security.
2. Choose Turn off next to the authenticator.
3. In Turn off two-step sign-in?, choose Turn off.
4. Confirm it is you (see below).

Signing in then needs only your password again. You can turn it back on at any time.

If you lose your phone

There is no way to remove two-step sign-in yourself without a code. Email [support@deepmarking.com](mailto:support@deepmarking.com) from your account's address. Once we have confirmed it is you, we remove two-step sign-in and sign you out everywhere. Sign in again, then set it up on your new phone.

Sign out other devices

If you signed in on a shared or lost computer, open Profile, then Security, and under Other devices choose Sign out other devices. The device you are using stays signed in. Every other device has to sign in again within the hour.

Changing or resetting your password also signs out your other devices.

Confirm it's you

Before some changes, DeepMarking asks you to confirm it is you in Confirm it's you:

• Changing or setting your password.
• Turning off two-step sign-in.
• Adding or removing a card.
• Changing your plan.

Enter your password and choose Confirm. You are not asked again for 10 minutes. You can choose Email me a code instead, and accounts without a password always get a code: enter the 6-digit code we email you. A code works once and expires in 10 minutes.

Deleting your account asks for your password in the delete form, or, for accounts made with Google, LinkedIn or X, an emailed code. See Delete your account.

This stops someone who finds your computer unlocked from making those changes. After too many wrong tries you see "Too many attempts. Wait 15 minutes, or reset your password if you have forgotten it."

Security emails

We email you when:

• Your password is changed or reset.
• Two-step sign-in is turned on or off.
• A card is added or removed.
• Your account is signed in from a browser it has not used before, such as Chrome on Windows.
• Your other devices are signed out.

Each email says when it happened and on which device. If it was you, there is nothing to do. If it was not, reset your password at once and reply to the email so we can help.