Guide
Account security
Two-factor authentication is optional for traders and mandatory for OWNER and ADMIN accounts. This guide covers setup, recovery, password resets and session control.
Set up two-factor authentication
You need an authenticator app — 1Password, Authy, Google Authenticator, Microsoft Authenticator or similar.
- 1
Open account security
Sign in and go to /account/security. - 2
Start setup
Select Set up two-factor authentication. A QR code and a manual secret appear. - 3
Add it to your authenticator
Scan the QR code, or open the provided link if you are on the same device. - 4
Confirm the first code
Enter the current six-digit code from the app. This proves the app is configured correctly. - 5
Save the recovery codes
Eight single-use codes are shown once. Store them offline, not in the same place as your password.
Signing in with 2FA
- Enter your email and password at /login.
- On the next screen, enter the current six-digit code from your authenticator app.
- If the app is unavailable, choose the recovery-code option and use one of the eight saved codes.
- Each recovery code works once and is then spent.
Lost your authenticator?
- Use a recovery code on the sign-in challenge.
- If no codes work, ask another OWNER or ADMIN to reset the account's 2FA. Traders should email info@traderdossier.com from the registered address.
- Sign in and set up 2FA again with a new secret.
Password, sessions and account data
Change your password
Use the change-password form under /account. Other sessions are signed out.
Forgot your password
Request a reset at /forgot-password. The link expires in 60 minutes.
Active sessions
Recent sign-in activity is shown under /account/security. Admins can revoke sessions at Admin → Authentication.
Delete your account
Use the delete option under /account. Reviews may be retained in anonymised form or removed under the review policy.
Staff and admin accounts
- 2FA is mandatory for OWNER and ADMIN.
- Without 2FA, admin pages redirect to `/account/security?required=admin-2fa`.
- Admin login, 2FA challenges and session revocations are recorded under Admin → Authentication.
- The last remaining OWNER cannot be demoted. Promote another owner first.