FlourivateHelp Center

Turn on two-step sign-in and other security settings

Last reviewed October 21, 2026

Protect your Flourivate account with an authenticator app, choose your sign-in alerts, and check who's been signing in.

When you're done, signing in to Flourivate needs your password plus a code from your phone, and you'll get an email whenever someone signs in from a new device. Your workspace holds client details, so this is worth ten minutes.

Before you start

  • Time: 10 minutes.
  • You need: an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
  • Have a safe place ready for your recovery codes, like a password manager.

Step 1: Open Security

  1. Go to Settings and scroll to Governance & Audit.
  2. Click Security. The page is called Security Settings.

Step 2: Turn on two-step sign-in for yourself

  1. Find My Multi-Factor Authentication. It shows Disabled until you set it up.
  2. Click to enable it. A QR code appears.
  3. In your authenticator app, add a new account and scan the QR code.
  4. Type the six-digit code from the app into Flourivate and confirm.
  5. Save the recovery codes Flourivate shows you. Each one gets you in once if you lose your phone.

Keep your recovery codes private

Treat them like passwords. Don't email them, post them in a support request or keep them in a screenshot.

Step 3: Require it for your team (optional)

Workspace Multi-Factor Authentication sets whether everyone who signs in to this workspace must use two-step sign-in. If you have team members, turn it on. If it shows Agency default (that's the Flourivate team), we've set it for you and you may not be able to lower it here.

Step 4: Choose your security alerts

Scroll to Security Alerts:

Alert What it does Suggested
New Device Login Emails you when your account signs in from a new device. On
Every Login Emails you on every sign-in. Off, unless you want it
Suspicious Activity Always monitored. Always On, no switch

After you flip a switch, reload the page to make sure it stayed.

Other settings on this page

  • Idle Timeout signs you out after a period of inactivity. If it shows Set by agency (that's the Flourivate team) with a lock, we manage it for you. Ask us if you need a different timeout.
  • IP Whitelist limits sign-in to specific internet addresses. Most practices should leave this empty. If you add an address, add the one you sign in from first, or you can lock yourself out.
  • Security Audit Log lists recent security events with Event, Date & Time and IP Address. Use it to check a sign-in you don't recognize.

Check it worked

  • My Multi-Factor Authentication no longer says Disabled.
  • Sign out and back in. Flourivate asks for your six-digit code.

If something's off

  • The code is rejected: check your phone's clock is set automatically. Authenticator codes depend on the right time.
  • You lost your phone: sign in with a recovery code, then set up two-step sign-in again on your new phone.
  • You lost your phone and your recovery codes: email us at hello@flourivate.com from the address you sign in with. We'll verify it's you and reset it.
  • A new device sign-in you don't recognize: change your password right away (your initials, top right), make sure two-step sign-in is on, then tell us.
  • There's no Security card: your role doesn't include it. Ask the workspace owner.

Related