Security

Your account holds your workspaces, your files and your plan, so it's worth protecting well. This page explains the security settings you control and how Tylode looks after your data.

Your password, two-step verification and open sessions are in Settings → Privacy and security → Security (click your name in the top bar, then Settings).

#Change your password

1. Go to Settings → Privacy and security → Security and find Password.
2. Fill in Current password, New password and Repeat the new one.
3. Click Change password.

The new password must be at least 8 characters long and different from the current one. Tylode asks for your current password so nobody can change it from a session you left open.

When it's done, you'll see "Password changed. Check your open sessions below and close any you don't recognise." It's a good moment to review your open sessions.

If you've forgotten your password, use Forgot it? on the sign-in screen instead. See Recover your password.

#Two-step verification

With two-step verification, signing in needs your password and a six-digit code that changes every 30 seconds on your phone. Even if someone gets your password, they can't get in without your phone.

You'll need an authenticator app on your phone: Google Authenticator, Authy, 1Password, or whichever you already use.

#Turn on two-step verification

1. Go to Settings → Privacy and security → Security and find Two-step verification.
2. Click Turn on.
3. Under 1. Scan this code with your app, scan the QR code with your authenticator app. If you can't scan it, click I can't scan it to see a text code and type it into the app instead.
4. Under 2. Enter the code your app shows, type the six-digit code.
5. Click Confirm.

Two-step verification is now On. From now on, you'll be asked for your app's code when you sign in. If you change your mind halfway through, click Cancel.

#Save your recovery codes

As soon as you confirm, Tylode shows you ten recovery codes. They let you sign in if you lose your phone.

1. Click Copy to copy them all, or Download .txt to save them as a text file.
2. Store them somewhere safe and separate from your phone, such as a password manager.
3. Click I've saved them.

This is the only time you'll see them. Each code works once.

The Two-step verification section shows how many codes you have left. If you're running low, or think someone may have seen them, click Generate new codes. You get a new set of ten and the old ones stop working. Save them the same way.

#Turn off two-step verification

Go to Settings → Privacy and security → Security and click Turn off in Two-step verification. Your recovery codes stop working too. You'll sign in with just your password until you turn it on again.

#Sign in with two-step verification

1. Sign in with your email and password as usual.
2. On the Two-step verification screen, open your authenticator app and type the six-digit code in Verification code.
3. Click Verify.

If the code is rejected, wait for the next one in your app and try again. Make sure your phone's clock is set automatically.

#Use a recovery code

If you've lost your phone:

1. On the Two-step verification screen, click Lost your phone? Use a recovery code.
2. Type one of your saved codes in Recovery code.
3. Click Use code.

Using a recovery code:

• turns off two-step verification on your account;
• signs you out of all your sessions, on every device;
• sends you an email to let you know a recovery code was used.

Then sign in again with your password and turn two-step verification back on in Settings → Privacy and security → Security. If you get that email and it wasn't you, change your password straight away.

To go back to the code from your app, click Back to the app code.

#Open sessions

Open sessions in Settings → Privacy and security → Security lists every place your account is signed in. Each entry shows the browser and system (for example "Chrome on Windows"), the IP address when available and when it was last active. The device you're using is marked This session.

• To sign out one device, click Close next to it.
• To sign out everywhere, including this device, click Sign out everywhere. This button appears when you have more than one session.

A closed device can't renew its access, but it can keep using the app for up to an hour, which is how long the permission it already had lasts. If you see a session you don't recognise, close it and change your password.

The Sign out option in the menu under your name only signs you out on the device you're using.

#Audit log

The audit log is a record of sensitive actions in a workspace. It's in Settings → Workspace → Audit log.

Premium The log is recorded on every plan, but reading it needs Premium on both your account and the workspace. Only owners and admins can see it.

It records these events:

The screen shows the 100 most recent events, newest first, with their date and time. To learn when pages leave the trash for good, see Trash retention.

#Limits on sign-in attempts

To slow down anyone trying to guess passwords or codes, Tylode limits how many times in a row you can try to sign in, create an account, request a password reset or use a recovery code. If you hit the limit, you'll see a message asking you to try again in a minute.

#How Tylode protects your data

• Hosted in the EU. Your data and files are stored on servers in the European Union (Ireland).
• Encrypted. Every connection uses HTTPS/TLS, and data is encrypted at rest (AES-256).
• Isolated workspaces. Each workspace is isolated from the others, and owners and admins decide who gets in and with what permissions.
• Passwords are never stored in plain text. They're stored hashed.
• API tokens aren't stored either. Tylode keeps only a hash of each token, and the session behind it is encrypted with the token itself: a copy of the database isn't enough to use anyone's API access.
• Dangerous files are blocked. Executables and formats that can carry code, such as HTML or SVG, are rejected when you upload.
• Payments by Stripe. Payments are processed by Stripe (PCI DSS Level 1). Tylode never stores your card details.

The full details are on the security page (in Spanish).

#Report a vulnerability

If you find a security problem in Tylode, write to security@tylode.com with the steps to reproduce it. Please don't share it publicly until we've fixed it.

#Security tips

• Turn on two-step verification, especially if you own a workspace or pay for a plan.
• Treat API tokens like passwords. A personal access token acts as you: it can read and change everything your account can, and it doesn't expire. Don't paste it into shared documents or public code, give each script its own token, and revoke the ones you no longer use in Settings → API and webhooks → API and plugins. See Authentication.
• Review connected apps. In Settings → API and webhooks → API and plugins, under Applications connected to your account, revoke any you don't use. See OAuth.
• Give the smallest role that works. Invite people as Read-only if they only need to read, and use custom roles instead of making everyone admin.
• Be careful with file links. Anyone who has the direct link to an uploaded file can open it, so don't paste file links in public places.
• Check your open sessions from time to time and close the ones you don't recognise.

#Related

• Your account
• Members, roles and teams
• Permissions and access
• Authentication