Security: two-step sign-in, single sign-on and support access

Your own authenticator

1. Open your account, under Two-factor authentication, and press Set up an authenticator app.
2. Scan the code with Google Authenticator, Microsoft Authenticator, 1Password or any app that shows six-digit codes.
3. Enter the code it shows and press Turn on. Your other devices ask for a code at their next sign-in.

There are no backup codes. Add a second authenticator app if you can; if you lose your only one, an administrator resets it for you.

Require it for everybody

1. As the company’s owner or administrator, open Administration → Authentication.
2. Switch on Require two-factor authentication. It applies at once, to sessions already open too. Whoever has no authenticator is asked to set one up before they can continue; the page lists who that is.
3. If somebody loses their authenticator, press Reset beside them and say why. It is recorded, and every administrator is told.

Single sign-on (SAML 2.0)

1. Under Domains, press Add domain and enter your email domain, such as example.com.
2. Add the TXT record it shows, at _trusterio-verification. followed by your domain, and press Verify. That is all: the domain does not need to point at Trusterio.
3. Under Authentication, press Claim a domain and enter it.
4. Press Configure, give your identity provider the service provider metadata address shown, and paste your provider’s metadata address or XML. Press Save.

Once it is active, everybody with an address at that domain signs in through your identity provider, and password sessions are ended. You can also say that signing in through it counts as two-step sign-in.

When Trusterio support looks at your account

• Only when supporting you, for one company at a time, with a reason, for 30 minutes unless set otherwise, and after signing in with their own second factor.
• Every visit is written in your audit log.
• To make any change, support has to ask. Owners and administrators are told, and the request appears on Authentication with Allow changes and Decline. Doing nothing is a no.

Passwords and devices

• Passwords are at least 12 characters. Change yours under your account; that signs you out everywhere else.
• Where you’re signed in lists your devices, each with Sign out.
• The audit log shows who did what and when, for one business or the whole company, and exports to CSV.