Account security

Email verification and passwords

Shared SaaS mode sends a single-use verification link after signup. A Member must verify that address before creating a company or accepting an invitation, and the signed-in address must exactly match the invitation recipient. New and reset passwords require at least 12 characters. A password change invalidates every older signed-in session. A password reset also revokes every personal API key because it is treated as account recovery after a possible credential compromise.

Changing your account email requires your current password. Genosyn keeps the existing address active and sends a single-use confirmation to the new mailbox; the identity changes only after that link is opened. Confirmation signs out older sessions and revokes personal API keys.

Enable two-factor authentication

1. Sign in and open Account → Security.
2. Add at least one method: an authenticator app, a passkey, or a USB security key. Adding the first method turns two-factor authentication on for your account.
3. Save the ten recovery codes when they appear. Each code works once and is never shown again.

Every method opens in its own dialog that carries you from naming the device through to the recovery codes without leaving the page. Each dialog asks for your current password at the point it needs it, so there is no separate confirmation field to fill in first.

Authenticator apps

Choose Add authenticator app, name the device, confirm your password, scan the QR code, then enter the current six-digit code to finish enrollment. The standard TOTP format works with 1Password, Google Authenticator, Authy, Microsoft Authenticator, and compatible apps.

Enroll as many as you like — a phone, a password manager, and a tablet can all hold a seed, and a code from any of them completes a sign-in. Each one is listed separately with the date it was added and last used, so you can remove a lost device without disturbing the rest. Names must be unique within your account. Each seed is encrypted on its own TotpCredential row, and Genosyn does not count it as a second factor until its first code verifies successfully.

Passkeys

Give the credential a recognizable name, then choose Add passkey. Your browser can offer Touch ID, Face ID, Windows Hello, a password-manager passkey, or a nearby device. The private key stays in the authenticator; Genosyn stores only the public key and verification counter.

USB security keys

Choose Add USB security key to steer the browser toward a roaming FIDO2 key. Insert or tap the key and complete its PIN or verification prompt. YubiKey 5 and other FIDO2/WebAuthn-compatible keys work; older OTP-only YubiKeys do not provide a WebAuthn credential.

HTTPS and the public URL

Browsers allow WebAuthn only on secure origins. localhost is the development exception; every remote deployment needs HTTPS. The public URL saved at Admin → General supplies the WebAuthn relying-party ID and origin, so it must exactly match the URL Members use to open Genosyn. See Configuration.

Sign in with 2FA

Enter your email and password, or complete SSO as usual. If your account has two-factor authentication enabled, Genosyn creates a five-minute verification step instead of a full session. Use any enrolled passkey/security key, a current authenticator code, or an unused recovery code. Eight failed second-factor attempts restart the sign-in flow. Failed-factor counters also persist in the database across replacement cookies and application replicas, so signing in with the password again does not reset the throttle.

SSO protections

OpenID Connect sign-in uses authorization code flow with S256 PKCE. Its single-use state is bound to the signed cookie of the browser that started sign-in, and Genosyn links or creates an account only when the identity provider affirmatively reports a verified email address.

Personal API keys

A personal API key is bound to exactly one company and is accepted only under that company's /api/companies/:cid REST surface. It cannot act as a browser session to change account identity or MFA, accept invitations, create companies, mint another key, or use instance administration. Password recovery and a confirmed email change revoke all of the account's personal API keys.

AI Employee delegation

A direct or Help conversation belongs to the Member who created it. Other Members in the same company cannot list, open, continue, or download attachments from that conversation. After an upgrade, older conversations without a recorded owner remain hidden from ordinary Members. An owner or admin can inspect one and use Claim conversation to assign it privately before continuing it. Claiming requires a sign-in from the last 15 minutes; sign in again if Genosyn asks you to refresh it.

During an interactive turn, both people in the delegation chain must be allowed to act: Genosyn intersects the requesting Member's current access with the AI Employee's Grants. For example, a Finance write needs the Member to have full Finance access and the AI Employee to hold the matching Finance Grant; a restricted Project must include both of them. Removing the Member or changing either side takes effect on the next tool call, even when a durable turn resumes after a restart.

Memory and repository context, coding and browser tools, company Connections and configured MCP servers are available in interactive chat only to owners and admins until those sources have resource-level provenance. An external chat channel that is not linked to an authenticated Member receives conversation-only replies: no Soul, Skills, company context, Memory, Grants, or company tools. Routine Runs and trusted internal automation continue to act with the AI Employee's Grants alone.

The same Member-bound authority applies when a person assigns a todo to an AI Employee or starts or retries a manual Mail handover. Those launches require a browser session and keep the accepting sign-in's revocation epoch. Routine Runs, Pipelines, and Mail rules remain explicitly trusted employee automation.

Manage methods

• Add more than one authenticator app, passkey, or security key so a spare device can get you back in.
• Remove individual methods from Account → Security. Removing the last method turns 2FA off and clears recovery codes unless a company you belong to requires 2FA.
• Generate new codes invalidates every existing recovery code immediately and displays a fresh set once.
• Turn off two-factor authentication removes every authenticator app, all passkeys/security keys, and all recovery codes.

Require 2FA for a company

An owner or admin who already has 2FA can open Settings → Company and turn on Require two-factor authentication. Members without a method must enroll one under Account → Security before they can access or join that company. Genosyn then prevents them from removing their final method. See the full hosted baseline in Shared SaaS mode.

Shared SaaS mode always requires master admins to enroll 2FA and to have completed both primary and second-factor authentication within the last 15 minutes before using the install-wide Admin APIs. An older operator session must sign in again.