Prospeno — Project Profit Tracker
Sign In
Administration
Included

Security & Email PIN 2FA

Protect company access with secure sign-in, password recovery, email verification, disabled-user controls, and an additional email PIN challenge for sensitive workspace access.

Layered sign-in

  • Company entry, account credentials, active-user checks, and optional Email PIN 2FA combine before workspace access continues.

Per-user Email PIN

  • Email PIN 2FA is an optional per-user setting. When enabled, a 6-digit code is emailed after successful password sign-in.

Not Kiosk PIN

  • Email PIN 2FA protects web account sign-in. It is separate from the 4-digit Kiosk Attendance PIN used on shared kiosk devices.

Security layers

Company entry point

  • Company code on /login or dedicated company login URL /c/your-company-slug
  • Resolves the intended workspace before credentials are checked

Account authentication

  • Each user signs in with their own email address and password
  • Credentials are checked against the company the user selected

Account and company status

  • Inactive companies, disabled users, wrong-company membership, and unverified email can block access

Additional email PIN challenge

  • When Email PIN 2FA is enabled for the user, a temporary 6-digit PIN must be entered after password sign-in

All required checks must pass

Access succeeds only when all required security checks pass.

Company login flow

  1. 1

    Open the company login page

    Use /login with a company code or open the dedicated company login URL such as /c/your-company-slug.

  2. 2

    Enter email and password

    Each user must use their own account. Generic invalid-credentials messaging is shown on failure.

  3. 3

    Complete CAPTCHA where required

    Registration and password-reset forms may require Cloudflare Turnstile when enabled. Standard sign-in does not currently show Turnstile on /login.

  4. 4

    Complete Email PIN 2FA when enabled

    If the user has Email PIN 2FA enabled, /login/pin collects the 6-digit code emailed after password sign-in.

  5. 5

    Enter the workspace

    After post-auth checks, users with force_password_change are sent to /change-password before normal workspace access continues.

Company code and login URL

Company code

  • Short company identifier entered on /login
  • Looked up through /api/auth/company-lookup before sign-in continues
  • May be remembered on the device in local storage

Dedicated company login URL

  • Company slug path such as /c/your-company-slug
  • Opens the branded or default company login form for that workspace
  • Company slug may be remembered separately from the company code
  • Invalid or unknown company codes return a company-not-found style error.
  • Inactive companies are blocked with a contact-support style message.
  • Users on the wrong company receive generic invalid-credentials messaging.
  • After logout, Prospeno may return users to the remembered company slug URL when available; otherwise /login restores a remembered company code.
  • Users can still sign in from the general /login page when they know the company code.
  • Custom Branding affects the company login appearance only when the company and module configuration support it.

Email and password

Sign-in rules

Identity

  • Each user must have a unique email address
  • Email is normalized to lowercase during sign-in

Password policy

  • Minimum 12 characters
  • Maximum 128 characters
  • Cannot start or end with spaces
  • Cannot match common weak passwords, the email local-part, or the company name

Error behavior

  • Invalid email or password returns a generic invalid-credentials message
  • Disabled users are signed out and told to contact their Admin
  • Wrong-company membership returns generic invalid-credentials messaging
  • Missing profile returns a contact-admin style error

Email verification

  • Users without a verified email are redirected to /verify-email after password sign-in

First password change

  • Users with force_password_change are redirected to /change-password before post-auth continues
  • Never share accounts
  • Use a unique password
  • Do not reuse passwords from other systems
  • Do not share one-time codes
  • Sign out from shared devices

Remember Me

Current behavior

  • The Remember Me control on /login and company login forms defaults to enabled
  • When enabled, the auth session is stored in browser localStorage
  • When disabled, the auth session uses sessionStorage and ends when the browser session ends
  • The UI label says “Remember me for 30 days,” which reflects the configured Supabase refresh-token lifetime rather than a separate Prospeno timer
  • Remember Me does not bypass Email PIN 2FA, email verification, forced password change, or disabled-user checks

Do not enable Remember Me on shared office, kiosk, or public devices.

Email verification

Verification flow

  • New account registration requires email verification before normal workspace access
  • After password sign-in, unverified users are signed out and sent to /verify-email
  • Verification links are sent through the supported email flow
  • Users can resend verification from /verify-email with a 60-second cooldown
  • Successful verification may show company login URL details for future sign-ins
  • Email PIN 2FA cannot be enabled until the account email is verified

Password reset

  1. 1

    Request password reset

    Open /forgot-password, enter the registered email, and complete Turnstile when shown.

  2. 2

    Open the reset email

    Use the reset link while it remains valid in the current Supabase recovery flow.

  3. 3

    Set a new password

    Choose a password that satisfies the current policy (minimum 12 characters).

  4. 4

    Sign in again

    Return to /login or the remembered company login URL and sign in with the new password.

  • Expired or invalid recovery links require requesting a new reset email.
  • Disabled users remain blocked even if a reset email is requested.
  • Company Admins can reset another user’s access from Users & Access with a new temporary password.
  • Users who no longer control the registered email need Admin or Prospeno support assistance.

First password change

force_password_change is active for new and reset accounts

  • Admins receive a temporary password once when creating a user or resetting access
  • Temporary passwords are shown in the Admin UI and are not emailed automatically
  • After temporary-password sign-in, users with force_password_change are redirected to /change-password
  • Workspace access continues only after the user sets a new password that satisfies policy
  • Admins can issue another temporary password reset if the user cannot complete the change

Email PIN 2FA overview

What it does

Email PIN 2FA adds a temporary email verification step after successful password sign-in.

  • It is optional and controlled per user in user_security_settings
  • It is not company-wide; only one second-factor method can be active per user (Email PIN or Authenticator App)
  • Authenticator App TOTP is a separate Admin/Manager option documented in Account Access & Recovery
  • When enabled, post-auth sends the user to /login/pin
  • A 6-digit PIN is emailed to the registered account email
  • The PIN expires in 10 minutes
  • After successful verification, a secure browser session marker allows continued access for up to 24 hours on that browser
  • Disabling Email PIN 2FA clears the active challenge and session marker

Enable Email PIN 2FA

  1. 1

    Open Security Settings

    Go to /settings?tab=security while signed in to the web workspace.

  2. 2

    Locate Email PIN 2FA

    Review the current Enabled or Disabled status badge.

  3. 3

    Confirm email verification

    Enable is blocked until the account email is verified.

  4. 4

    Enable the setting

    Select Enable Email PIN 2FA for your own account.

  5. 5

    Save and test

    Sign out and sign in again to confirm the PIN challenge appears on the next password login.

  • Each user enables or disables Email PIN 2FA for their own account.
  • The toggle is available in Settings → Security on the web workspace.
  • Enabling does not automatically sign out other active sessions, but the next fresh password login requires a PIN.
  • No test PIN is sent at enable time; the challenge is created on the next sign-in that requires it.

Email PIN challenge

  1. 1

    Credentials accepted

    Email and password pass primary sign-in and post-auth reaches pin_required.

  2. 2

    PIN is generated and delivered

    A new 6-digit PIN is emailed through the supported login PIN email flow.

  3. 3

    User enters the PIN

    Enter all 6 digits on /login/pin before expiry.

  4. 4

    Verification succeeds

    Successful verification completes sign-in and allows workspace entry.

  5. 5

    Invalid or expired PIN

    Retry carefully, resend when allowed, or cancel and sign out.

Resend, expiry, and retry

  • Situation

    PIN sent

    Meaning

    A current unused challenge is active for up to 10 minutes

    User action

    Check the registered email inbox and spam folder

  • Situation

    Invalid PIN

    Meaning

    The entered code did not match

    User action

    Re-enter carefully before using another attempt

  • Situation

    Expired PIN

    Meaning

    The challenge passed its expiry time

    User action

    Request another PIN

  • Situation

    Too many attempts

    Meaning

    Five failed attempts on the active challenge

    User action

    Request a new code

  • Situation

    Resend cooldown

    Meaning

    A new code cannot be sent until 60 seconds have passed

    User action

    Wait for the countdown, then use Resend code

  • Situation

    Delivery delayed

    Meaning

    Email provider delay or spam filtering

    User action

    Check spam and resend when allowed

Status table

Resending invalidates previous unused PIN challenges for the active login attempt.

Disable or recover Email PIN 2FA

Disable

  • The signed-in user can disable Email PIN 2FA from Settings → Security
  • No current-password confirmation is required in the current UI
  • Disabling clears the 2FA session marker and invalidates active login PIN challenges
  • Enable/disable events are recorded in auth security audit history

Recovery

  • If the user still controls the registered email, use Resend code on /login/pin
  • If email access is lost, another company Admin may assist with account access review
  • Prospeno support may be required when the registered email is inaccessible or email delivery is misconfigured
  • Internal Super Admin tools are not part of the customer self-service flow

Disabled users and inactive companies

Disabled user

  • The company profile remains preserved
  • Sign-in is blocked with a contact-admin message
  • Password reset alone does not restore company access

Inactive company

  • Company lookup fails or reports inactive before sign-in continues
  • Correct user credentials do not override company-level restriction

Role and project assignment do not override disabled-user or inactive-company checks.

Reactivation follows supported administration in Users & Access or billing/support workflows.

CAPTCHA / Turnstile

Supported forms

  • Registration and forgot-password forms may render Cloudflare Turnstile when configured
  • Standard /login and company login forms do not currently require Turnstile
  • Turnstile helps reduce automated abuse but does not replace password or PIN verification
  • Users may need to retry after network or browser issues
  • JavaScript and a supported browser are required when Turnstile is shown

Session and logout behavior

Session behavior

  • Authenticated sessions persist according to Remember Me storage and Supabase session settings
  • Email PIN 2FA uses a secure browser session marker for up to 24 hours after successful PIN entry on that browser
  • A fresh password login clears the prior 2FA marker before issuing a new PIN challenge
  • Logout signs the user out and may return them to the remembered company login URL
  • Role or permission changes may require workspace refresh or a new sign-in to update navigation
  • Disabled users are blocked on subsequent auth and API checks even if an old browser session appeared active briefly

Security settings permissions

  • Action

    Open Settings → Security in web workspace

    Admin

    Yes

    Manager

    Route blocked

    Supervisor

    Route blocked

    Employee

    Route blocked

  • Action

    Enable or disable own Email PIN 2FA

    Admin

    Yes — Settings → Security

    Manager

    API supports per-user toggle; web Settings route blocked

    Supervisor

    API supports per-user toggle; web Settings route blocked

    Employee

    API supports per-user toggle; web Settings route blocked

  • Action

    Reset another user’s access

    Admin

    Yes — Users & Access

    Manager

    No

    Supervisor

    No

    Employee

    No

  • Action

    Change own password

    Admin

    Yes — Settings, /change-password, or recovery flow

    Manager

    Yes — supported auth flows

    Supervisor

    Yes — supported auth flows

    Employee

    Yes — supported auth flows

  • Action

    Use password reset

    Admin

    Yes

    Manager

    Yes

    Supervisor

    Yes

    Employee

    Yes

Permission matrix

Email PIN 2FA vs Kiosk PIN

Email PIN 2FA

  • Temporary authentication challenge
  • Sent through email
  • Protects workspace sign-in
  • 6 digits
  • Expires in 10 minutes
  • Belongs to account security

Kiosk Attendance PIN

  • Four-digit (4-digit) employee attendance identifier
  • Used on shared kiosk devices
  • Identifies an employee for attendance
  • Subject to kiosk lock and rate-limit rules
  • Does not replace web account authentication

Security events and audit history

Recorded auth security events
  • Email PIN 2FA enabled
  • Email PIN 2FA disabled
  • Login PIN challenge sent
  • Login PIN verification success
  • Login PIN verification failure
What customers can see today

Settings → Security shows last sign-in time from the active session.

Last password change is not tracked in the current UI.

There is no full customer-facing security-event dashboard yet.

Common access problems

Wrong company code or URL

Confirm the company code or company login URL with your Admin before retrying sign-in.

Invalid email or password

Use the supported forgot-password flow or ask your Admin to verify the account is active and assigned to the correct company.

Verification email not received
  • Check spam or junk folders
  • Confirm the email address is correct
  • Use resend from /verify-email after the cooldown
  • Contact support if delivery still fails
Password reset link expired

Request a new password reset from /forgot-password.

PIN not received
  • Check the registered email inbox and spam folder
  • Wait for the resend cooldown and use Resend code
  • Confirm Email PIN 2FA is enabled and email delivery is configured for the environment
User disabled

Contact your company Admin to review account status in Users & Access.

Company inactive or subscription restricted

Contact the company Admin or billing owner. Subscription and platform state may block access even with valid credentials.

Role changed but access looks unchanged

Refresh the workspace or sign out and sign in again so navigation and route guards pick up the new role.

Security guidance

  • One account per person
  • Use unique passwords
  • Never share passwords, temporary passwords, or PINs
  • Do not enable Remember Me on shared devices
  • Disable former staff promptly
  • Keep Admin access limited
  • Protect the registered email account
  • Review company security settings regularly
  • Use supported reset and recovery flows
  • Report suspicious access to the company Admin and Prospeno support

Important limitations

  • Email PIN 2FA depends on access to the registered email account.
  • Email delivery may be delayed by the recipient’s email provider.
  • Remember Me should not be used on shared devices.
  • CAPTCHA does not replace password or PIN verification.
  • Disabled users cannot regain access through password reset alone.
  • Role and project assignment do not override account or company restrictions.
  • Email PIN 2FA is separate from the Kiosk Attendance PIN.
  • Password recovery depends on the supported email flow.
  • Some recovery cases may require another Admin or Prospeno support.
  • Authenticator App (TOTP) is available separately for Admin and Manager accounts; it cannot be active at the same time as Email PIN 2FA.
  • Prospeno does not provide hardware security keys or SMS 2FA in the current implementation.
  • Security controls reduce risk but do not replace responsible account management.

Where to find help

Use the ? button in the web application for the current page guide, Getting Started, Module Guides, and Contact Support.

Related links

Jump to the module, marketplace, or broader help resources.

Security & Email PIN 2FA Guide — Prospeno Docs