Account security · Systemly

Change your password

Open your workspace, then go to Settings → Profile & security.
In Password, enter your current password and a new one twice.
Select Change password.

Your new password must have at least 10 characters and a number. Changing it signs out every other active session, but keeps the device you are using signed in. The profile page shows how many active sessions you have; it does not provide a per-device session list or a separate sign-out-everywhere button. Use Sign out in the account menu to end the current session.

Reset a forgotten password

On the sign-in page, select Forgot password.
Enter your account email and open the reset link sent to it.
Set a new password, then sign in again.

A reset link expires after one hour and works only once. A successful reset ends all existing sessions, including the device where you opened the link. If the link has expired, request a fresh one. For security, the request screen does not confirm whether an email address has an account.

Turn on two-step verification

Go to Settings → Profile & security and find Two-step verification.
Select Turn on and scan the QR code with an authenticator app, or enter its key.
Enter the current code from the app to finish setup.
Copy or download the recovery codes and store them away from your authenticator.

Verification is not switched on until you enter a working code, so abandoning setup halfway does not lock you out. Starting setup again issues a new QR code; scan that one, not an old one.

After setup, sign-in asks for your password and then a six-digit code from the app. You have ten minutes after entering your password to enter the code before you have to start again. Repeated wrong codes are rate-limited.

Use a recovery code

You get ten recovery codes when you turn verification on. If you lose the authenticator, select Lost your phone? Use a recovery code on the sign-in code screen. Hyphens and letter case do not matter, so type the code however it reads.

Each recovery code works once, even if the sign-in that follows fails.
The profile page shows how many codes remain, and warns you when none are left.
New recovery codes asks for a current code from your authenticator app, or one unused recovery code, then issues a fresh set of ten and cancels every old code. You get an email when this happens.
Turning verification off requires a current authenticator code or an unused recovery code, so someone using your unlocked laptop cannot remove it.

Verify your phone number

Go to Settings → Profile & security and find Phone number.
Enter your mobile number starting with the country code, for example +61 400 123 456, then select Send code.
Enter the six-digit code from the text message and select Verify.

The country code is required because Systemly never guesses it: a local number read as international can belong to someone in another country. The number is used to reach you about your account. It is never shown to anyone in your workspaces, and it is not a way to sign in on its own.

A code expires after 10 minutes. Requesting another cancels the previous one.
After five wrong attempts the code stops working; request a new one.
You can request up to five codes an hour.
A number you have entered but not confirmed shows as Unverified. Select Remove to delete a verified number.

If you suspect account access

Change your password from a trusted device. That ends other active sessions while keeping your current one.
Turn on two-step verification and replace any recovery codes that may be exposed.
Review workspace access and API keys under Settings. Revoke any key you do not recognise; changing a password does not revoke API keys.
If you cannot sign in, reset your password or contact support from your account email.

See API key security for key rotation and Team permissions for workspace access.