# Account & security

Your account is one email address. You sign in with a password or with a code sent to that
address. Your personal settings are under "User settings" in the account menu.

## Create an account

"Create an account" has three steps: "Your details", "Create password" and "Verify email".

1. Fill in "First name", "Last name" (optional) and "Email address", and tick "I have read
   and accept the terms".
2. Choose a password. It needs at least 8 characters, one uppercase letter, one lowercase
   letter, one number and one symbol.
3. Open the email dembrane sends you and click the link. You then read "Your email is
   verified. Log in to continue."

Until you verify your address you cannot sign in with your password. No email? Use "Resend
verification email". You can ask for a new one every 60 seconds.

> [!TIP]
> Were you invited? Register with the address the invite was sent to. An invite works only
> for that address. See [invites & access](./invites-and-access.md).

The first time you sign in, dembrane asks a few questions about how you plan to use it. You
can skip them. If nobody invited you, you first name your organisation and can invite your
team.

## Sign in

Enter "Email" and "Password" and choose "Log in". You stay signed in for 7 days, and longer
while you keep using dembrane.

To sign in without a password, choose "Email me a sign-in code instead" and then "Email me
a code". You get a six-digit code that works for 10 minutes.

## One device at a time

Your account can be signed in on one browser at a time. If you sign in on a second one, you
see:

> "This account is logged in somewhere else"
>
> "It has been logged in on another device since {date and time}. For security, an account
> can be logged in on one device at a time."

- "Log in anyway" signs you in here and signs the other device out.
- "Back to log in" leaves the other device signed in.

This applies to password and code sign-ins alike. The screen shows only since when the
other device has been signed in. If you clear your browser's site data, the same browser
counts as a new device.

## Two-factor authentication

With two-factor authentication on, signing in also asks for a six-digit code from an
authenticator app.

To turn it on, go to "User settings", "Account & security", "Two-factor authentication":

1. Enter "Account password" and choose "Generate secret".
2. "Scan the QR code or copy the secret into your app."
3. Enter the code your app shows and choose "Enable 2FA".

From then on, after your password, you see "Authenticator code": "Open your authenticator
app and enter the current six-digit code."

To turn it off, use the same switch. You need a valid code: "Enter a valid code to turn off
two-factor authentication."

dembrane shows no backup codes, so keep your authenticator app within reach.

## Password

- To change it, go to "User settings", "Account & security", "Change password". Fill in
  "Current password", "New password" and "Confirm new password", then "Save".
- Forgot it? The link "Forgot your password?" appears on the sign-in page after a wrong
  password. Enter your email and choose "Send reset link". You read: "If an account exists
  for {email}, we sent it a link to reset your password. Check your inbox and spam folder."
- Resetting your password signs you out everywhere.

## Your settings

"User settings" has four sections.

| Section | What is in it |
|---|---|
| "Account & security" | Your avatar (PNG, JPEG or WebP, at most 5 MB, cropped to a circle), "Display name", your "Email", "Change password" and "Two-factor authentication" |
| "My access" | "This is a map of every organisation and workspace you are a member of." It shows your role and the plan for each one |
| "Appearance" | "Theme" ("System", "Light", "Dark"), "Font size" and "Language" |
| "Assistant" | "Notes the assistant keeps about how you like to work, saved during your chats. Only you see these. Remove anything you don't want it to keep." |

The interface comes in eight languages: English, Dutch, German, French, Spanish, Italian,
Ukrainian and Czech. You can also change the theme and the language from the account menu.

The default legal basis for new projects is not a personal setting. It is set for each
workspace. See [data ownership & compliance](./data-ownership-and-compliance.md).

## Email address, deleting your account, your data

- Your email address is shown in your settings and cannot be changed.
- The dashboard has no button to delete your account or to download your data. Both are
  requests to dembrane. What dembrane then does is described in
  [data ownership & compliance](./data-ownership-and-compliance.md#requests-about-your-own-data).

## Related

- [Invites & access](./invites-and-access.md): joining an organisation or a workspace.
- [Roles & permissions](./roles-and-permissions.md): what your role lets you do.
- [Notifications](./notifications.md): the inbox and the emails dembrane sends.
- [Chat & Ask](./chat-and-ask.md): where the assistant's notes come from.
- [Account & settings for hosts](../users/host/account-and-settings.md): the same, step by step.