Account security & MFA

Add a second layer of protection to your account with two-factor authentication (2FA). With 2FA on, signing in needs both your password and a short code from an app on your phone — so a stolen password alone isn’t enough.

Where to find it:

Studio staff: click Your account in the left navigation. It opens the Account security page.
Customers: choose Profile in the menu, then the Security tab.

One Tobren account

Your Tobren password works across Tobren Deliver and Tobren Operations through a single shared account directory. It is one account, not two that happen to share an email address — so changing your password in one place changes it in both, and two-factor authentication you turn on here protects you in both.

Two things follow from that, and they surprise people:

Signing up for one product when you already use the other does not create a second account. If we recognise your email, we’ll ask you to sign in with the password you already have rather than asking you to pick a new one.
Your authenticator app is set up once per account, not once per product. If you have already enrolled, you will not be asked again.

Turn on two-factor authentication

Tobren Deliver uses authenticator apps (TOTP) — the same kind used by Google Authenticator, 1Password, Authy, Bitwarden, and similar.

Two-factor authentication protects a password, so it’s offered only on an account that has one. If you only ever sign in with Google or Apple, the page says so and gives you a set a password link; set one first, then come back.

Open the security page (see above) and click Enable 2FA.
Scan the QR code with your authenticator app (or type in the manual entry secret it shows, if you can’t scan).
Enter the 6-digit code from the app and click Verify and enable.
You’ll be asked to confirm it’s you once more. If you confirm with a code, use the next one your app shows — each code works only once.
Save your recovery codes (next section) — this is the only time they’re shown.

From then on, signing in with your password asks for a code from your app.

Recovery codes

When you enable 2FA you’re given a set of one-time recovery codes. If you lose your authenticator app, you use one on the sign-in page: it removes the authenticator from your account so you can sign in with your password, and you’re then asked to set two-factor authentication up again.

Save them somewhere safe (a password manager is ideal). They’re shown only once. The Done button unlocks after you use both Copy all and Download.
Each code works once. Your remaining count is shown on the security page.
If you’re running low — or think a code may be exposed — click Replace recovery codes (or Get recovery codes if you have none left). You’ll confirm it’s you first. A new set replaces the whole old set; the old codes stop working.

If you lose both your authenticator app and your recovery codes: studio staff can ask a workspace admin, who can reset two-factor authentication for any non-admin member from the Team page. A reset signs that person out on every device, so they sign in again with their password and set up a new authenticator. Admins and customers should contact support to recover access.

Require 2FA for your whole workspace (admins)

If you run a team, you can require all staff to use 2FA. In Settings → Security, under Studio two-factor policy, tick Require 2FA for password-signed-in staff in this workspace.

Once it’s on, any staff member — in any of the five roles — who signs in with a password and hasn’t set up 2FA is sent to set it up before they can use the workspace.
It does not cover people who sign in with Google or Apple: they are never prompted, and we can’t see whether their Google or Apple account has two-step verification turned on. The Team list marks anyone in that position; enforce two-step verification in their Google Workspace or Apple account settings to close the gap. The policy doesn’t apply to your customers.
You can turn the policy off at any time.

This pairs well with Team members & roles — set the policy once and every current and future staff member is covered.

Your password

Change it while signed in. On the security page (staff) or the Change password tab of your Profile (customers), enter your new password twice and click Change password. You’ll be asked to confirm it’s you first (see Confirming it’s you), and your other devices are signed out. Because your password belongs to your Tobren account, the new one works in Tobren Operations too. If you only sign in with Google or Apple, you have no password to change, so you won’t see this section.

Forgot it? On the sign-in page, choose Forgot password?, enter your email and click Send reset link. If an account with that address exists, we send a link that works for 1 hour. It opens Set a new password: choose one at least 8 characters long, confirm it, and sign in with it. The page never says whether an address has an account, so a message that the link was sent doesn’t mean one exists.

If the link has expired or was already used, the page says This reset link doesn’t work and offers Send a new link.

Studio staff can change the address they sign in with from Your account, under Login email. Enter the new address and click Send confirmation link.

The link goes to the new address and expires in an hour. Nothing changes until you click it. Your current address keeps working until then.
Once you confirm, you’re signed out everywhere and sign in again with the new address.
You’ll be asked to confirm it’s you first (see below), and only you can do this, not a workspace admin.

Verifying your email

When you sign up with a password, we email a link that opens Verify your email and confirms your address; after Email verified you can sign in. The link works for 3 days. If it has expired, the page says so: sign in with your email and password to get a new link. (Resetting your password also confirms your email.)

Sign out everywhere

Studio staff: if you’ve lost a phone or laptop, or think someone else has your account, click Sign out everywhere on the Your account page, then Yes, sign out everywhere. It ends your session on every device, including this one, and you’ll sign in again. You’ll be asked to confirm it’s you first. If it can’t reach the server, the page says your other devices are still signed in, so try again.

Confirming it’s you

Some changes can hand your account to someone else if they happen on a session that isn’t really yours — a laptop left signed in, or a stolen session. So before you change your password, change your sign-in email, turn two-factor authentication on or off, get new recovery codes, or sign out everywhere, Tobren Deliver asks you to confirm it’s you:

with your password, or
by signing in again with Google or Apple, if that’s how you sign in.

Once you’ve confirmed, you won’t be asked again for a few minutes, so you can finish what you started. If you sign in with Google or Apple, use the same account you’re signed in with now.

When our support team is helping you from inside your account, these changes are never available to them — only you can make them.

Turning 2FA off

You can turn 2FA off from the same security page with Turn off for my whole account. You’ll confirm it’s you first. It turns 2FA off everywhere you use this email address, not just in Tobren Deliver.

Admins — order matters: if you want to turn 2FA off for yourself and your workspace still requires it, turn the workspace requirement off first (the section above). If you turn your own 2FA off while it’s still required, you’ll be sent to set it up again the next time you sign in with your password — so you’d have to set your own 2FA back up just to get in and change the policy.

What’s next

Manage who’s on your team → Team members & roles
Control your data and deletion requests → Data, privacy & deletion