# Sign-in and account security

How you'll sign in to Shipment Insight and keep your account safe: passwords, passkeys, two-factor authentication, recovery codes, and control over your sessions and devices. Sign-in is rolling out now.

> **Rolling out:** Sign-in with email, password and two-factor codes is live. Passkeys, account settings and the other features below arrive next; anything marked **Later** comes after that.

## At a glance

| Feature | What it does | Status |
| --- | --- | --- |
| Password | Email and password, checked against known data breaches. | Rolling out |
| Passkeys | Sign in with your fingerprint, face or device PIN. Nothing to remember or type. | Rolling out |
| Two-factor authentication | A 6-digit code from an authenticator app, on top of your password. | Rolling out |
| Recovery codes | One-time codes to get back in if you lose your phone or security key. | Rolling out |
| Sessions and devices | See where you're signed in, and sign out of any device. | Rolling out |
| New sign-in emails | An email when your account is used from a new device. | Rolling out |
| Organization security policies | Admins require two-factor for everyone, and more. | Rolling out |
| Single sign-on (SSO) | Sign in with your company's own identity system. | Later |

Shipment Insight runs its own sign-in system. Your credentials are not handled by a third-party login provider.

## Signing in

- Go to the sign-in page and enter your **work email** and **password**.
- If your account uses two-factor authentication, enter the **6-digit code** from your authenticator app. Lost your phone? Choose **Use a recovery code** instead.
- You land on the page you were trying to open.

If the email or password is wrong, we say only that they don't match. We never confirm whether an account exists. After too many attempts, wait a few minutes before trying again.

To sign out, open the account menu (your initials, top right) and choose **Sign out**. **Sign out everywhere** ends every session on every device, including this one.

## Signing in to more than one company

One email is one account, even if you work with several companies on Shipment Insight (for example a broker that also runs its own trucks). There's only one password and one two-factor setup to manage.

1. After your password (and two-factor code, if asked), you see **Choose a company** with each company's name, type and region. Pick the one you want to work in.
2. If you belong to only one company, you go straight in.
3. To change later, open the account menu (your initials, top right) and choose **Switch company**. Navigation, data and permissions change to match that company.
4. Some companies ask for more, such as two-factor authentication or a shorter session. If the company you pick needs a fresh sign-in, we sign you out and ask you to sign in again, then you choose it.

Switching is recorded in that company's audit log, like any sign-in. Shipment Insight staff sign in the same way; when support needs to look at your company, the access is read-only, time-limited, needs a written reason and appears in your audit log.

## Passwords

- Length matters more than symbols. A long passphrase, like four or five unrelated words, is strong and easy to remember.
- Passwords that appear in known data breaches are refused, even if they look complex.
- We never ask you to change your password on a schedule. We ask only if there's a sign it was exposed.
- Passwords are stored only as a slow, salted hash. Nobody at Shipment Insight can see your password.
- Repeated wrong attempts slow down further attempts, to stop guessing.

> **TIP:** Use a password manager, and a different password for every site. Or skip passwords entirely with a passkey.

## Change your password

- Open the user menu (your initials, top right) → **Change password**, or **Settings** → **Change password**.
- Enter your current password, then the new one twice. The hint under the field shows how strong it is; at least 12 characters (your organization may require more).
- The new password can't be your current one, can't appear in known data breaches, and can't contain your name, your email or the product name.
- When you save, **every other device and browser where you're signed in is signed out**. The one you're using stays signed in.
- The change is recorded in the security log of every company you belong to, and we send you a security notice.
- Too many wrong current passwords count like wrong sign-ins: wait a moment before trying again. Shipment Insight staff in support mode can't change anyone's password.

## Passkeys

A passkey lets you sign in with the same fingerprint, face or PIN you use to unlock your phone or computer. It can't be phished: it only works on the real Shipment Insight site. It's the most secure way to sign in, and the quickest.

1. Go to **Settings** and open your security settings.
2. Choose to add a passkey and follow your device's prompt.
3. Add a second passkey on another device, or a hardware security key, as a backup.

## Two-factor authentication

With two-factor authentication on, signing in with a password also asks for a 6-digit code from an authenticator app on your phone. Someone who steals your password still can't get in.

- Any standard authenticator app works.
- A passkey already counts as two factors, so you won't be asked for a code when you use one.
- Codes by text message (SMS) are not offered for sign-in, because they can be intercepted.
- Admins must use two-factor authentication or a passkey.

## Recovery codes

When you turn on two-factor authentication, you get a set of **recovery codes**. Each one works once, in place of an authenticator code. Print them or keep them in your password manager, away from your phone.

> **WARNING:** If you lose your phone and your recovery codes, ask your organization's admin to reset your two-factor authentication. For your safety, Shipment Insight support can't skip this check for you.

## Sessions and devices

- Your security settings list every device and browser where you're signed in, with its approximate location and last activity.
- Sign out of one device, or use **sign out everywhere** to end every session except the current one.
- Changing your password or resetting two-factor signs you out everywhere else automatically.
- Sessions end after a period of inactivity.

## New-device emails

When your account is used from a device or browser we haven't seen before, you get an email with the time, the device and the approximate location. If it wasn't you, use the link in the email to secure your account: it signs out that session and asks you to change your password.

## Confirming sensitive changes

Some actions ask you to confirm it's really you, even if you're already signed in: changing your email or password, turning off two-factor, creating an API key, or changing someone's role. You confirm with your passkey or an authenticator code. This protects you if someone gets hold of an unlocked computer.

## Organization security policies

Admins can set rules for everyone in the organization:

| Policy | Effect |
| --- | --- |
| Require two-factor | Everyone must set up two-factor or a passkey before they can use the console. Admins always need it. |
| Allowed methods | For example, passkeys only. |
| Session length | How long people stay signed in without activity. |
| Single sign-on | Require sign-in through your company's identity system (later). |

Sign-ins, two-factor changes, role changes and API key changes are recorded in your organization's audit log. See [Privacy and data](https://shipmentinsight.com/docs/privacy-and-data#audit-log).

## API keys

Systems don't sign in with a password; they use scoped API keys. See [API overview](https://shipmentinsight.com/docs/api-overview#authentication).