Security

Your user is the key to every account you belong to — including the organization’s balance and its phone lines. Securing it is not optional for anyone with the Owner role, and it’s cheap: two-factor authentication takes a minute to set up and is required on every sign-in afterwards.

Everything on this page is per user, not per account: it follows you across every account you can access. Settings → Security, and Profile from the user menu.

Profile

Your name, email and phone number, and which are verified. Email is verified by a link at sign-up; the phone by a 6-digit SMS code (valid 10 minutes). Both are needed before an account can place calls, and the phone is what receives an SMS notification if you enable one.

Changing your email or phone repeats the verification for the new value. Connected accounts shows whether Google sign-in is linked.

Signing in

Two ways, and you can have both on one user:

• Email and password. Change the password from Security; the current password is required to set a new one. A user created through Google can add a password here to sign in either way.
• Continue with Google. Links your Google identity to the user. Google handles the credential; Talkif still applies your two-factor setting.

Failed sign-ins are rate-limited per address — a handful of quick attempts, then a slow trickle — so a password can’t be brute-forced, and you may briefly be locked out after several typos.

Two-factor authentication

Time-based one-time passwords (TOTP), compatible with Google Authenticator, Authy, 1Password and any standard app.

To disable, confirm with your current password. If you’re an organization Owner, consider it mandatory; you’re the only person who can change the organization’s billing.

Sessions

Security → Sessions shows this device’s session. Log out of other devices ends every session except the current one — the right response to a lost laptop or a suspected compromise. Changing your password does not by itself end other sessions; do both.

Next