Security, automatic sign-out and profile
Set up automatic sign-out after inactivity, password rules, expiry and two-factor authentication, and manage your password, email address and signed-in devices in your profile.
allverto protects your data by signing you out automatically after a period of inactivity. In your profile you manage your password, email address and the devices you are signed in on.
Automatic sign-out
If there is no activity, allverto signs you out after a fixed time – by default after 30 minutes. Activity means mouse, keyboard, touch and scrolling. Things happening in the background (e.g. lists that refresh themselves) don't count.
Two minutes before the time runs out, a notice appears with a countdown and the buttons Stay signed in and Sign out now. All tabs and windows share the same state: if you are working in one tab, the other one stays signed in too. allverto saves unsaved changes to orders before signing you out and offers to restore them the next time you open them.
Setting it up
Open gear → Security:
| Setting | Who | Values |
|---|---|---|
| Company default | Owner | 15, 30, 60, 120, 240 or 480 minutes |
| My setting | every person, per company | a shorter time or "Company default" |
The shorter of the two times always applies. You can't go longer than the company default. If the company lowers its default, longer personal values fall back to "Company default". You can also see the effective time in the user menu (the circle with your initials) under "Automatic sign-out: …".
My profile
Open the user menu at the top right → My profile. The page fits on roughly one screen:
- My account: change and save your Name. Next to it you see your sign-in email, Password last changed, Account since and Last signed in.
- Change password: the Change button next to Password last changed. In the popup enter Current password, New password and Repeat new password. A meter shows the strength. The Sign out on all other devices switch is turned on by default. You receive a confirmation by email.
- Change email address: the Change button next to the email address. In the popup enter the New email address and your current password. allverto sends a confirmation link to the new address (valid for 24 hours) and a notice to the old one. The new address only applies once you have confirmed it.
- Security: two-factor authentication (status, Set up or New recovery codes, and Disable), the Email when signing in from a new device switch and Automatic sign-out (your own time, as above).
- Language: My language and – if you have the “Edit company details” permission – the company's default language next to it.
- Companies: which companies you are a member of and with which role, with company switching. Below it, a note on how to leave a company.
- Devices: the Signed in tab with your sessions (device, shortened IP address, last activity) – sign out each session individually or use Sign out all others. The Workstations tab with the devices on which you have set up printers. Both lists show five entries at first, the rest via Show all.
Password rules
New passwords – at sign-up, in the invitation, in your profile and via “Forgot password” – must meet these rules:
- at least 12 characters,
- letters and digits,
- at least one special character, e.g.
! ? # - _(spaces do not count).
The rules are listed below the field; the ones you meet get a check mark. Easy to remember and still secure: a sentence of several words with a number and punctuation – or a password from your password manager. The rules apply to all companies; existing passwords remain valid until they expire.
Password expiry
A password is valid for 365 days from the last change. 14 days before, a notice appears in the header, and your profile shows under Password last changed until when it is valid. Once it has expired, allverto only shows the Set a new password window after sign-in – you can continue only afterwards.
Two-factor authentication
Two-factor authentication is mandatory for all users: after the password, allverto asks for a 6-digit code from an authenticator app (e.g. Microsoft Authenticator, Google Authenticator or 1Password). Anyone who has not set it up yet does so at the next sign-in before continuing:
- Scan the QR code with the app (or type in the key).
- Enter the current code from the app.
- Keep the 10 recovery codes in a safe place – they get you into your account even without your phone.
With Trust this device for 30 days, allverto does not ask for a code in this browser for 30 days. Two-factor authentication cannot be turned off; you can create new recovery codes in your profile at any time. Lost your phone? An owner resets two-factor authentication under Gear → Security. There, the company also decides for which roles it additionally requires two-factor authentication – the requirement for all users applies regardless.
Forgot password
On the sign-in page choose Forgot password? and enter your email address. The link is valid for one hour and can only be used once; afterwards you are signed out everywhere.
Frequently asked questions
I can't find my device in the list.
allverto recognises the device by its browser. The same person using two browsers on one PC therefore appears twice. Simply sign out any unknown sessions and change your password to be safe.
Can I leave the company via my profile?
The profile shows a note about this: the owner or an administrator can remove you from a company under Users.