> ## Documentation Index
> Fetch the complete documentation index at: https://docs.officeridge.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Center

> Two-factor authentication, sessions, trusted devices, login history, and privacy controls.

The Security Center covers account security, privacy and compliance.

Every authenticated user can open it and manage their own account security.

## Account security

| Setting                       | What it does                                         |
| ----------------------------- | ---------------------------------------------------- |
| **Two-Factor Authentication** | Add a verification code in addition to your password |
| **Password & Policy**         | Review the password policy and reset your password   |
| **Change Email**              | Update your sign-in email with verification          |
| **Active Sessions**           | View and manage signed-in devices                    |
| **Login History**             | Review recent sign-in attempts                       |
| **Trusted Devices**           | Manage devices that can skip 2FA                     |
| **Security Alerts**           | Review flagged sign-ins and new devices              |
| **Account Recovery**          | Set recovery email, phone and trusted contact        |

## Organization and privacy

| Setting                   | What it does                                           |
| ------------------------- | ------------------------------------------------------ |
| **Single Sign-On**        | Configure SAML / OIDC for your organization            |
| **Organization Settings** | Profile, branding, team, billing and location settings |
| **Integration Hub**       | Webhooks, Box storage, and external connectors         |
| **Consent & Privacy**     | Control data processing and cookie preferences         |
| **Data Export**           | Download a copy of your data                           |
| **Legal Documents**       | Terms of Service and Privacy Policy                    |
| **Account Deletion**      | Permanently delete your account                        |

## Turning on two-factor authentication

Because OfficeRidge holds protected health information, two-factor authentication is the single most
useful thing you can do to protect member data.

<Steps>
  <Step title="Open Two-Factor Authentication">
    From the Security Center.
  </Step>

  <Step title="Follow the setup prompts">
    You will register an authenticator app that generates verification codes.
  </Step>

  <Step title="Save your backup codes somewhere safe">
    These are how you get in if you lose your device.
  </Step>

  <Step title="Set up account recovery">
    Recovery email, phone, and trusted contact give you a route back in.
  </Step>
</Steps>

<Warning>
  Store your backup codes outside OfficeRidge and outside the device running your authenticator app.
  Backup codes kept only on the phone you are authenticating with are useless when that phone is lost.
</Warning>

## Trusted devices

A trusted device can skip the two-factor prompt on subsequent sign-ins.

<Warning>
  Only trust devices you personally control. Never trust a shared or public computer — anyone using it
  afterwards can reach your account, and therefore member records, without a verification code.
</Warning>

Review trusted devices periodically and remove any you no longer use.

## Reviewing security alerts and login history

<Steps>
  <Step title="Check security alerts">
    Flagged sign-ins and new devices appear here.
  </Step>

  <Step title="Review login history">
    Look for sign-ins you do not recognise — unfamiliar times, locations, or devices.
  </Step>

  <Step title="Check active sessions">
    End any session you do not recognise.
  </Step>

  <Step title="Change your password if anything looks wrong">
    Then remove unrecognised trusted devices.
  </Step>

  <Step title="Report it">
    Tell your compliance officer. Unauthorised access to an account with member data may be a
    reportable security incident. See [HIPAA compliance](/compliance/hipaa).
  </Step>
</Steps>

<Warning>
  An unrecognised sign-in on an account with member record access is potentially a HIPAA security
  incident, not just a personal account problem. Report it rather than simply changing your password
  and moving on.
</Warning>

## Data export and account deletion

Data export lets you download a copy of your data. Account deletion permanently removes your account.

<Warning>
  Account deletion is permanent. It is separate from organization deletion — deleting your own account
  does not delete your agency's records, and it will remove your access entirely. If you are leaving
  the agency, an admin should remove you from the organization team instead.
</Warning>

## Troubleshooting

| Problem                                     | What to check                                                                 |
| ------------------------------------------- | ----------------------------------------------------------------------------- |
| I lost my 2FA device                        | Use a backup code, then your account recovery options.                        |
| I have no backup codes and lost my device   | Contact an Organization Admin or support.                                     |
| A sign-in in my history is not mine         | End the session, change your password, remove trusted devices, and report it. |
| Two-factor is prompting on a trusted device | The trust may have been removed, or the device changed. Re-register it.       |
| I cannot change my email                    | Email changes require verification. Check the verification message.           |

## Related

<CardGroup cols={2}>
  <Card title="HIPAA compliance" icon="shield" href="/compliance/hipaa">
    Security incidents and the PHI access trail.
  </Card>

  <Card title="Account" icon="user-cog" href="/account/profile">
    Your display name and preferences.
  </Card>
</CardGroup>