Your account & security

Click your name at the bottom of the sidebar to open your account settings — Profile, Preferences, Notifications, Security, and API tokens in a left-hand rail, inside the app like every other page, so the sidebar and search stay within reach. Each section has its own URL, so links like /account/security land exactly where you expect.

Signing in

Sign in with your email address or your username: both work, with a password or through your organization’s single sign-on.

• Without single sign-on, the sign-in page is one form: email or username, password, Sign in.
• With single sign-on (Enterprise), the page asks for your email or username first. Continue takes you straight to your identity provider (Microsoft, Google, Okta…) when your organization signs you in there, or asks for your password otherwise. If your organization offers two ways, you pick one. Use a password instead skips the question when you know you have a CompassDocs password, and Other ways to sign in, under a password field, lists the single sign-on buttons. Which path you get is set by your administrators (see Email-first sign-in).

A few things help on the way:

• Show password, under the password field, shows what you typed. It turns itself off before the form is sent, so your browser can still offer to save the password.
• Caps Lock is on. appears under the password field while it is.
• The page remembers you. The email or username you last signed in with on this browser is filled in next time (it is never sent until you press the button). Not you? Use another account clears it. It is kept for 180 days in this browser only, never in a cookie; clearing the site’s data in your browser forgets it too.
• Change next to your email or username takes you back a step to fix a typo.
• If you have set up two-factor authentication, the page asks for your code after the password (see Two-factor authentication).

First sign-in, or a password an admin reset: you are asked to Set a new password before anything else, on a page that looks like the sign-in page, with your account shown at the top and Sign out beside it in case it isn’t you. Show passwords shows all three fields. Your password manager is offered the new password for the right account.

Your administrators can add a line of help under the form (who to contact, a link), and an example email in the empty field.

Signing in from a link

A link to a document, a search or any other page works while you are signed out: you are taken to the sign-in page and, once you sign in — with a password or through single sign-on, and even if a first-login password change comes first — you land on the page the link named, not the dashboard. Only pages in this workspace are remembered; a link that points elsewhere falls back to the dashboard.

Profile

Your display name, email, and an optional profile photo (it’s resized in your browser before upload; your initials remain the fallback everywhere a photo isn’t set). Usernames are permanent — they anchor history, comments, and sign-in. An email another account already uses can’t be saved, since an email signs you in. If your workspace uses single sign-on, an email you set yourself counts as unconfirmed until an administrator confirms it, so ask them before your first SSO sign-in.

SSO and SCIM accounts

If you sign in through SSO or are provisioned by SCIM, your name and email are read-only here — change them in your identity provider and they update on your next sign-in.

Preferences

• Theme — Light, Dark, or Auto. Saved to your account, so it follows you to any browser you sign in from; the sidebar toggle writes through to the same setting.
• Page width — Normal / Wide / Full (Wide is the default), applied app-wide, settings pages included. The same toggle appears at the top of every document. Document body text keeps a readable column inside whichever width you pick — and the column grows as you widen the page, so Full gives you longer lines than Normal without ever running edge to edge. Panels and media — tables, code blocks, diagrams, images, callouts, accordions, tabs, video and embeds — use the full width at every setting. On a document, Normal places the side panel (sub-pages, related documents, attachments) below the text so the column stays readable; Wide and Full keep it beside the text. Full is a wide, centred page rather than edge to edge, so an ultrawide monitor gets margins instead of 3,000-pixel lines.
• Interface scale — Compact (90%), Default, Large (110%) or Larger (120%). The interface already grows with your monitor — everything is about 12% larger on a 2560-pixel-wide screen than on a laptop, and card grids add columns as the page gets wider — so most people never touch this. Pick Large or Larger on a 32-inch or ultrawide screen, Compact to fit more on a laptop. It scales the sidebar, controls, icons and text together, and browser zoom still works on top. Printing is unaffected.
• Time zone & date format — personal overrides of the workspace defaults. Every timestamp in the app follows them — documents, history, the audit log, analytics, account security, the dashboard — and the weekly digest arrives Monday morning in your time zone, formatted your way.

Notifications

What reaches you where — a per-event grid covering mentions, comment replies, subscribed-space updates, change requests, review decisions, review reminders, and read confirmations, each with its own in-app, webhook, and (where an email exists) email switch. Everything is on by default; unchecking stores a personal opt-out. Subscription emails and the weekly digest keep their own master switches below the grid, next to your personal chat webhook and subscribed-spaces list.

Two-factor authentication (2FA)

Add an authenticator-app code to your password sign-in (Manage account → Security → Set up two-factor auth):

1. Scan the QR code with any TOTP app — 1Password, Google Authenticator, Microsoft Authenticator, Authy… (or type the manual key).
2. Enter the 6-digit code it shows to confirm the app works. 2FA is only enforced after this succeeds, so a bad scan can’t lock you out.
3. Save the recovery codes — eight one-time codes, shown exactly once. Any of them signs you in if you lose your authenticator (each works once).

From then on, password sign-ins ask for your current 6-digit code after the password. Use a recovery code switches the field to a recovery code (on a phone it opens a keyboard with letters), and Use your authenticator app switches back; Back returns to the password. A code is never sent on its own as you finish typing it (press Verify or Enter), because a mistyped code counts towards the five-attempt lockout. Turning 2FA off again requires a valid code.

SSO accounts

People who sign in through SSO get MFA from your identity provider (Entra, Okta, and the like) — CompassDocs 2FA applies to password sign-ins.

Locked out?

• Lost authenticator, have recovery codes → sign in with a recovery code, turn 2FA off under Security, re-enroll with the new device.
• Lost both → an admin can clear your 2FA from Settings → Users → ⋯ → Reset 2FA…; you sign in with just your password and re-enroll. The reset is written to the audit log.

Active sessions

Manage account → Security → Active sessions lists every device where you’re signed in — browser and OS, IP address, and when it signed in, with your current device marked. You can:

• Sign out any single session, or
• Sign out everywhere else — instantly revokes every session except the one you’re using. Do this if you signed in on a shared machine or lost a device.

Admin password resets also revoke all of a user’s sessions automatically.

Passwords & API tokens

• Change password — at the top of the Security section. It asks for your current password first; five wrong ones from the same address lock password changes, and signing in with your username from there, for 15 minutes (since 1.16.0), and each wrong one is recorded in the audit log.
• API tokens & connected apps — personal tokens for the Claude connector and other integrations, plus the one-click apps you’ve approved. Both revocable anytime.