Protect every account with two-step sign-in

Require it for your whole team

Owners and admins can require two-step sign-in for everyone in the business from the Team screen. Tourtify asks you to turn it on for your own account first, so you can't lock yourself out, and the confirmation says how many team members don't have it yet. The switch is recorded in the activity log.

Once it's required, anyone without two-step sign-in is taken to the set-up page and can't use the console until they finish. They can still switch to another business or sign out. The team list marks the people who haven't set it up, and the access review download shows each person's status, so you can follow up before the season starts.

A smooth rollout takes a week. Tell the team which apps work, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy, ask everyone to set it up and save their recovery codes, check the access review for anyone missing, then switch the requirement on. People who set it up in advance never see the blocking screen.

For a tour business this matters because staff accounts reach traveller names and contact details, payments and refunds. A single reused password on a guide's phone should not be enough to reach all of that.

How the codes work, and fixing common problems

Tourtify uses the standard time-based codes that authenticator apps produce: six digits that change every 30 seconds. To allow for a phone clock that is slightly out, the code just before and just after the current one are also accepted. If setup says the code didn't match, check that your phone sets its time automatically, then try the newest code.

Each code works only once. If a code is rejected because you already used it, wait for the next one. After your password, you have ten minutes to enter the code before the sign-in starts again. Ten wrong codes for one account within a quarter of an hour, from any device or network, send you back to the password step and make you wait, which stops anyone guessing codes.

Recovery codes done properly

The eight recovery codes look like k7f2-9wqp and can be typed in upper or lower case. Tourtify stores only a fingerprint of each code, never the code itself, so they can't be read back even by Tourtify. Keep them away from your phone, for example in a password manager on your computer or printed and filed in the office safe.

To use one, choose Lost your phone? Use a recovery code on the code screen. After signing in, set two-step sign-in up again on your new phone. Making new recovery codes asks for your password and cancels the old set, so do this whenever you suspect a copy has been seen. Turning two-step sign-in off also asks for your password.

Where it protects you beyond sign-in

If you connect an AI assistant to your business with the MCP plugin and grant access that Tourtify treats as high risk, you are asked for a fresh code from your authenticator app before the connection is made. When your business requires two-step sign-in, team members without it can't connect such apps at all.

Tourtify's own staff who can open the super admin must use two-step sign-in before they can continue, which protects every business on the platform if a staff password leaks.