Your own account

Click your name/email at the bottom of the sidebar to open My Account.

In the Profile section, edit your display name and/or mobile number.

Type the mobile the way you normally write it (e.g. 0491 570 006); it's saved in full international form using your organisation's country. Start it with + and a country code for an overseas number.

Click Save changes. If the number isn't a valid mobile you'll be told, since a landline can't receive the SMS notifications it's used for.

In the Password section, click Change password.

Enter your current password, then your new password (a single field). It must be at least 8 characters and include at least one special character (e.g. ! @ # $ % &).

Click Update. The change takes effect immediately; you do not type the new password twice.

In the Sign-in email section, click Change email.

Enter the new email address and your current password (to confirm it's you).

Click Send confirmation. A confirmation link is sent to the new address (and a heads-up notice to your old one).

Your email only changes after you click the link in the new inbox. Until then, your current email keeps working. The link expires in 24 hours.

In the Notifications section, toggle email and/or SMS notifications.

SMS requires a mobile number saved in your Profile first.

Click Save preferences.

The email notifications switch controls two things: the weekly digest of overdue and idle records (owners and admins), and the alert telling you a customer has replied to a record you are assigned to (everyone, including members). Switch it off and you get neither, and nobody else is emailed in your place.

In the Notifications section, fill in "Also send notifications to" with any address you also want notifications to reach, then click Save preferences.

From then on, notification email goes to both your sign-in email and that address: the weekly digest, alerts fired by stream automations, and quote, invoice and support notifications.

Security email never goes there. Password resets, invitations, email verification and email-change confirmations only ever reach your sign-in email, so the second address can't be used to take over your account.

It is not verified and is not an identity: you cannot sign in with it, and it is not a recovery address. If you need a backup for password resets, use Recovery email instead.

Leave the field blank and save to turn it off. It must be different from your sign-in email.

An owner or admin can also set this for you on /settings/users.

In the Passkeys section, optionally give it a name (e.g. "My laptop"), then click Add a passkey.

Your device prompts you to use Windows Hello, Touch ID, your phone, or a security key.

Once added, you can sign in with the Sign in with a passkey button on the login page; no password needed. Remove a passkey any time with its Remove link.

Passkeys only work on the live site domain, not on preview URLs.

In the Two-factor authentication section, click Enable two-factor and confirm your password.

Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy), or enter the shown key manually.

Save your backup codes; each works once if you lose your authenticator, and they're only shown at setup.

Enter the current 6-digit code to confirm and turn 2FA on. After this, sign-in asks for a code after your password.

You can later regenerate backup codes or disable 2FA from the same section (both require your password).

In the Recovery email section, enter a backup email address (different from your sign-in email) and confirm your password, then click Send verification link.

Open the link sent to that inbox to confirm it; the address then shows as Verified. The link expires in 24 hours, and the address isn't active until you confirm.

If you ever forget your password and can't get into your main inbox, use Forgot password? on the login page and enter your recovery email; the reset link is sent there.

You can Change or Remove your recovery email at any time from the same section.

If an owner/admin has turned on a security requirement (Require two-factor authentication and/or Require passkeys on /settings/users), you must keep a matching factor set up.

You can still add or replace passkeys and regenerate backup codes, but the Remove / Disable control for your last satisfying factor is locked (shown as "Required") with an explanation.

If both 2FA and passkeys are required, keeping either one is enough, so you could remove a passkey as long as you still have 2FA on, and vice versa.

This is enforced on the server too, so it can't be bypassed.