Key Benefits for Your Team

Whether your staff sign in from the front desk, a back office laptop, or a personal phone, Secure Login is designed to keep access simple for the right people and firmly closed to everyone else.

The Available Verification Methods

Signing in always begins with a password. Secure Login simply asks to verify your username when it matters most. Any combination of the methods below can be set up, and having more than one means there is always a backup way to sign in.

The Secure Login Flow

Here is the everyday journey at a glance. Most of the setup happens only once, and after that, everyday sign in stays fast.

The sign in screen: User ID, password, and property code

First Time, Verify Your Username

The first time anyone signs in after Secure Login is enabled on their account, their username is verified using one of the available methods: SMS OTP, WhatsApp OTP, Email OTP, or an Authenticator App. Verification is mandatory for every user, and setting up more than one method is strongly encouraged for the strongest protection and the easiest recovery.

The Secure Your Account screen shown right after first login

The verification process, step by step

The walkthrough below uses Phone (SMS or WhatsApp) as the example. Email OTP works the same way, and the Authenticator App is set up by scanning a QR code.

Confirm the number and pick a channel

Enter the 6 digit code within the countdown

Verified: the method is now active

Email OTP follows exactly the same pattern. Confirm the address already on file and select Send Verification Code, open the email containing the 6 digit code, then enter it to activate the method.

Confirm the address and request a code

The code arrives by email

Verified: Email OTP is now active

The Authenticator App needs no phone number or email. Select Setup on the Authenticator App card, scan the QR code with an app such as Google Authenticator, Authy, or Microsoft Authenticator, then enter the 6 digit code it generates to confirm. From then on the app produces a fresh code every 30 seconds, even offline.

Scan the QR code, then confirm with a generated code

Trusted Device

Trusting a device is never offered during the first sign in or method setup. It only appears the next time sign in happens, once at least one method is already active and verified.

The OTP entry screen, where the Trust This Device option appears

After the 30 days

Once the trusted period ends, the next sign in simply asks to verify again, and trust can be renewed in the same step. Sign in with the usual credentials or Login with OTP, enter the code from any verified source, tick Trust This Device again, and the device is trusted for another 30 days. If the box is left unticked, verification is simply required again next time. Nothing is lost, and the account stays protected either way.

Login with OTP

Login with OTP allows sign in using a one time code instead of typing a password. On a trusted device, this becomes the fast everyday way to sign in. This option is available only after at least one verification method has been set up and verified.

The sign in screen offers Sign in with passkey and Sign in with OTP

Choose where to receive the code, then select Send Code

Passkeys

A passkey allows sign in with a device fingerprint, face, or PIN, with no one time code needed. Each passkey is tied to a specific device, for example a front desk computer. Once one is added, a Sign in with passkey button appears on the sign in screen.

From Account Settings, open Security and MFA, then Passkeys, and select Manage Passkeys. Select Add a Passkey, give it a name to recognise the device later (for example Reception or Front Desk), then select Create Passkey and follow the device prompt (Windows Hello, Touch ID, Face ID, or a hardware key). The passkey is saved and listed with the date it was added and last used.

The Passkeys panel: saved passkeys and the Add a Passkey button

On the sign in screen, select Sign in with passkey, then confirm with a fingerprint, face, or PIN. Sign in happens instantly, with no OTP required.

Naming a passkey before creating it

Account Settings

Account Settings is the security home base for every user. It has two tabs: Profile, holding name, email address, mobile number, and role (the source of every OTP), and Security and MFA, holding verification methods, passkeys, password, signed in devices, and recent activity.

The Security and MFA tab: sign in methods, passkeys, active sessions, and recent activity in one place

The Profile tab, where contact details are stored

Reading the status badges

Updating Email and Phone Number

Email address and mobile number live on the Profile tab, the single source of truth for every OTP. When either one changes, a careful two part verification confirms the change so no one can quietly redirect a user’s codes.

Changing the number tied to sign in is a deliberate 3 step wizard: enter the new number and pick WhatsApp or SMS, verify the current number to prove ownership, then verify the new number before it replaces the old one. To start, go to Security and MFA, then Phone / WhatsApp OTP, then Manage, then Change Phone Sign In.

Change phone sign in: enter number, verify current, verify new

Password and Device Management

Passwords and signed in devices can both be managed from Security and MFA, keeping account hygiene simple and quick.

A password can be changed at any time from Security and MFA, then Change Password, or directly from the password expiry reminder that appears after login. Open Change Password, enter and confirm a new password that meets the on screen requirements, then select Save. The new password takes effect immediately, and no current password needs to be re entered while already signed in through an active session.

The password expiry reminder popup

Under Security and MFA, then Active Sessions, every browser currently trusted to bypass repeat verification can be reviewed, and any unrecognised entry can be removed. Each entry shows the browser, device, and when it was last active, with the current session clearly labelled. A single device can be signed out with Logout, or every other session can be ended at once with Logout All Other Sessions, the fastest way to lock out a lost or stolen device.

Active Sessions, with Logout and Logout All Other Sessions options

Recent Activity

Just below Active Sessions, Recent Activity is a timestamped log of security relevant events on an account. Each entry shows what happened, the device or browser and IP address where available, and when it occurred. Typical entries include recent logins and sign in attempts, authentication events such as MFA verification completed, device activity such as trusted device added, and other security actions such as password changes and method updates.