# Account security
Two-factor, backup codes, the devices signed in as you, and the way back if you lose your phone.
Your AffiliateRail account can generate a payout batch. It also holds the PayPal or Wise
credentials that money leaves through. So it needs more than a password.
Everything here's in the dashboard under **Settings**, **Security**.
## Two-factor
Two-factor means a second check on top of your password: a six-digit code from an authenticator
app on your phone.
- It's optional to turn on, so nobody is forced into it while they're still deciding whether to buy.
- It's required before a payout batch moves, so nobody sends other people's money with a password
alone.
Go to **Settings**, **Security**, **Turn on two-factor**. You type your password first, so somebody
who finds your screen unlocked can't do this. Signed up with Google? There's no password to type.
If you signed in more than 15 minutes ago, you choose **Continue with Google** first instead.
Scan the square with an authenticator app: 1Password, Google Authenticator, Authy, whatever you
already use. If you can't scan, the same secret is printed beside it to type in by hand.
Type the six digits the app shows. Nothing is switched on until this matches. An app that wasn't
set up properly can't lock you out.
Save the ten backup codes. **This is the only time they're shown.** Put them in your password
manager, not in your email.
From then on, signing in asks for your password and then the code. If you sign in with Google or
Apple, you're asked for the code there too.
### Backup codes
A backup code gets you in when you don't have your phone. You get ten, and each works once.
- The Security tab shows how many are left.
- Using one sends you a note saying it happened.
- When you're running low, **New backup codes** replaces the whole set.
The old ten stop working the moment the new ten appear. Save them before you close the page.
### Turning it off
Turning it off needs your password **and** a current code. One of the two isn't enough. If you
signed up with Google, you have no password, so it takes the code. Let's say
someone steals your session and also knows your password. That's exactly the case a second factor
exists for, so without a code they still can't remove it.
## Who on your team can do what
Everyone on your team has one of three roles. You pick admin or member when you invite someone, under **Settings**, **Team**. There's one owner: the person who made the account. The owner can't be removed.
| What | Owner | Admin | Member |
| --- | --- | --- | --- |
| See everything in the dashboard | Yes | Yes | Yes |
| Look after partners: add, review, tag, notes, emails and resources | Yes | Yes | Yes |
| Change the program's name, branding and signup questions | Yes | Yes | Yes |
| Remove a partner, or change their group, rate or payout minimum | Yes | Yes | No |
| Approve or decline leads your partners send in | Yes | Yes | No |
| Approve, reject, edit or add commissions | Yes | Yes | No |
| Make, send, mark paid, change or delete payouts | Yes | Yes | No |
| Change commission rules, attribution, safeguards and coupons | Yes | Yes | No |
| Add, move or remove customers, or change a customer's email | Yes | Yes | No |
| API keys, webhook settings, domains, imports, sample data and new programs | Yes | Yes | No |
| Connect PayPal or Wise to pay partners | Yes | No | No |
| Change your plan or card, cancel, or open Stripe | Yes | No | No |
| Connect Paddle | Yes | No | No |
| Invite or remove people on your team | Yes | No | No |
| Ask us to delete a partner's or customer's data | Yes | No | No |
If your role can't do something, you're told so and nothing changes. On **Team** and **Billing**, those buttons don't show at all. The check runs on our server, so it holds even if a button is on the screen.
## Before a payout batch moves
These ask you to confirm it's you:
- generating or sending a payout batch, or turning on automatic payouts
- marking a payout paid, or deleting one
- changing what a payout holds: one amount, a percentage across all of it, or taking a commission out
- adding, testing or removing a payout connection
If two-factor is on, you type a code. The confirmation lasts fifteen minutes, in the browser you're
using. Approving three batches in a row takes one code. A browser somebody else is holding gets
none of it.
If two-factor isn't on, you're asked to set it up there and then, with the reason on the screen.
## Devices signed in as you
The Security tab lists every browser signed in to your account. For each one it shows:
- what the device looks like
- roughly where it signed in from
- when the session started
- when it was last used
The one you're reading this in is marked.
**Sign this one out** ends a single session at once. **Sign out of every other device** ends all
of them and leaves you signed in here.
There are two limits:
- The device is whatever the browser says it is. Two laptops running the same browser on the same
operating system look the same.
- The location comes from the network address, so it's approximate. A city that looks wrong usually
means your internet provider, not somebody else.
## Recent activity
This list shows sign-ins, failed attempts, password changes and resets, email changes and every
change to your second factor.
It's newest first, with the device and rough location beside each one.
Look here first if something feels off. It's worth a glance after any email from us about your
account.
## If you lose your phone
**With your backup codes**: sign in as usual, choose **Use a backup code instead**, and type one.
Then turn two-factor off and on again on the new phone. That gives you a fresh set of ten.
**Without your backup codes**: there's still a way back. It doesn't depend on your email address on
purpose, because your email is the thing an attacker is most likely to have.
On the code screen, choose **There's a way back in**. Then sign in with your email and password.
Only somebody who knows your password can start a recovery.
We show you a TXT record, a line of text you add to your domain's DNS settings. Publish it on your
website's domain, wherever you bought the domain. Control of that domain proves it's you. You can
do it at three in the morning without waiting for anybody.
Press **I have published it**. DNS usually takes a few minutes.
Wait 72 hours. Your codes keep working the whole time. We tell the address on your account what's
happening, and one press cancels it. The wait stops an attacker getting in straight away.
Come back, sign in with your password, and two-factor comes off. Set it up again on the new phone
straight away.
Maybe your program has no website on file, or you no longer control the domain. Then write to
[support@affiliaterail.com](mailto:support@affiliaterail.com) from an address at your company's own
domain. The same waiting period applies.
If you get an email saying a recovery was started and it wasn't you, cancel it. Do that from the
email or from the Security tab, then change your password. A recovery can't be started without it.
## Emails you'll get from us
Each of these sends a note to the address on your account:
- turning two-factor on or off
- replacing your backup codes
- using a backup code
- signing in from a device we haven't seen before
Signing a device out, or signing out everywhere else, sends no note. The Security tab's activity
list records it instead. A password change has its own note.
They always come from affiliaterail.com, so a broken DNS record on your own sending domain can
never silence them. Unsubscribing from anything never affects them either.
## Partners
Partners sign in to the portal with a link sent to their email. They hold no password and none of
your payout credentials, so there's no second factor on that side.
Their own payout details are encrypted at rest. They're never shown back to you or to us in full.
## What isn't here
Single sign-on (SSO) and SAML let your team sign in through your company's identity provider.
There's no switch for them in this tab. They're an Enterprise conversation, so if you need them,
say so when you talk to us.