Security & Two-Factor Authentication

Sign in securely

1
Open the correct company
Use the company code on /login or the company’s dedicated login URL.
2
Enter your own email and password
Accounts are checked against the selected company. Do not share credentials.
3
Complete the account checks shown
Follow the email-verification and temporary-password prompts that apply to your account. A required password change must be completed before normal workspace access.
4
Complete the configured second factor
Enter the emailed PIN when Email PIN is enabled, or the current code from your authenticator app when Authenticator is enabled. Follow the challenge shown for this sign-in.
5
Continue to your authorized workspace
Completing sign-in does not change your company role, project assignments, or module permissions.

The emailed 6-digit PIN expires after 10 minutes. A new code cannot be requested more often than the 60-second resend cooldown.

Email PIN is a per-user setting, not a company-wide requirement applied to every employee.
Admins and Managers can configure their own supported security settings. A Manager’s Security tab does not grant company-administration access.
Use the verified email for the account and the newest valid code.
Never share a one-time PIN with another person or with support staff.

Authenticator uses time-based one-time codes from your enrolled authenticator app rather than an emailed PIN.

Open your personal Security settings and follow the Authenticator setup and verification prompts.
Setup is not complete until the enrollment is verified and the enabled method is confirmed.
At sign-in, use the current code for the correct Prospeno account. Check automatic device time if current codes are rejected.
If you lose access to the authenticator, use only recovery options actually offered by Prospeno or contact support for the supported recovery process. A password reset is not a substitute for a required second-factor challenge.

Admins and Managers manage their own personal Security settings; company-wide settings remain Admin-only.
Complete the current verification required by the Security screen before changing or disabling an enabled method.
Follow the supported switch flow between Email PIN and Authenticator. Do not delete an authenticator entry before the replacement method is confirmed.
If verification is unavailable or the session has expired, sign in again or retry through the supported flow. Do not share an authorization link, code, or session cookie to complete a check elsewhere.

Password length: 12 to 128 characters.
Do not begin or end a password with spaces.
Avoid common weak passwords, the email name, or the company name.
Use Forgot Password when you cannot sign in with the current password.
Admins can reset supported user access; temporary credentials should be shared privately.

Use an individual account for each person.
Disable access promptly when someone leaves the company.
Use the lowest role appropriate for the person’s work.
Do not send passwords, one-time codes, recovery links, private keys, session cookies, or banking credentials to support.