Security Settings

Keep your Workestra account secure with password management, two-factor authentication, and session monitoring.

Screenshot needed � add an annotated image showing this UI

Password Management

Changing Your Password

1. Navigate to Settings > Security
2. Scroll to the Password section
3. Enter your current password
4. Enter your new password (minimum 8 characters)
5. Confirm the new password
6. Click Update Password

Password Requirements

Two-Factor Authentication (2FA)

Add an extra layer of security with Time-based One-Time Password (TOTP) authentication.

Enabling 2FA

1. Go to Settings > Security
2. Click Enable Two-Factor Authentication
3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
4. Enter the 6-digit code from your app
5. Save your backup codes in a secure location
6. Click Verify and Enable

Using 2FA

After enabling, you'll be prompted for a 6-digit code:

• Every time you sign in
• When switching devices
• After clearing browser cookies

Disabling 2FA

1. Go to Settings > Security
2. Click Disable Two-Factor Authentication
3. Enter your current password to confirm
4. 2FA is immediately disabled

Active Sessions

Monitor and manage devices where you're currently signed in.

Viewing Active Sessions

The Active Sessions section shows:

Revoking Sessions

To sign out of another device:

1. Find the session in the list
2. Click Revoke or Sign Out
3. That device is immediately logged out

Revoke All Sessions

To sign out everywhere (including your current device):

1. Click Revoke All Other Sessions to keep only your current session
2. Or click Sign Out Everywhere to end all sessions including this one

Brute Force Protection

Workestra automatically protects against password attacks:

Session Timeout

For security, inactive sessions are automatically ended:

• Web sessions: 7 days of inactivity
• Mobile sessions: 30 days of inactivity
• API keys: No automatic expiration

Security Best Practices

For Your Account

1. Enable 2FA — The single best security improvement
2. Use a password manager — Generate and store unique passwords
3. Revoke old sessions — Regularly review active sessions
4. Keep email secure — Your email is your account recovery method

For Your Workspace

1. Limit Owner/Admin roles — Only trusted individuals
2. Use custom roles — Grant minimum necessary permissions
3. Review audit logs — Monitor for suspicious activity
4. Enable SSO — For enterprise security requirements

What to Do If You Suspect Unauthorized Access

1. Change your password immediately
2. Revoke all active sessions
3. Review audit logs for suspicious activity
4. Contact your workspace admin if you see unauthorized actions
5. Contact support at security@workestra.app for urgent issues

---

Next Steps

• Data & Privacy — GDPR export and audit logs
• Roles & Permissions — Workspace access control