Sign-in uses a password and a second step: a code from an authenticator app or a passkey such as Face ID, Touch ID, Windows Hello or a security key. Your organization can require it for everyone or for high-risk actions, and backup codes cover a lost phone. Sensitive actions, like saving system credentials, ask for a fresh check even inside a session. Organizations can also sign in through their own identity provider, and every action is recorded in the audit log.
How do you set up two-step verification?
- Start from your first sign-in or SettingsNew members set it up when they accept their invitation. Later, go to Settings, then Security.
- Add an authenticator app or a passkeyScan the code with an authenticator app and enter the 6-digit code, or add a passkey on your device. You can add more than one passkey.
- Keep your backup codesSave the backup codes somewhere safe. Each works once, for when your phone or device is not to hand.
Why does Naarvin ask again before some actions?
Some actions are sensitive enough to need a fresh check even when you are already signed in, such as verifying a supplier's bank details or turning on sending to your ERP. Saving the credentials of a connected system always asks. Under Settings, then Security, your organization chooses whether to require a fresh check for sensitive actions and two-step verification for everyone or for high-risk actions. After you enter a code you are not asked again for 5 minutes.
Can we sign in through our own identity provider?
Yes. Under Settings, then Security, an administrator can set up single sign-on over OpenID Connect or SAML 2.0 with signed assertions. SCIM 2.0 can add, update and deactivate people from your identity provider, so leavers lose access when they leave.
What else protects your organization?
| Control | Where to find it |
|---|---|
| Who can see which company | Settings, then Users & access |
| Who approves what | Settings, then Approval limits |
| A record of who did what and when | Settings, then Audit log |
| Suspending a member | Settings, then Users & access |
| Where AI processing may happen | Settings, then Security |
Passwords and keys to your systems are encrypted and never reach the AI. Read more on our security page.
Questions people ask
I lost my phone. How do I sign in?
Use one of your backup codes, then set up a new authenticator or passkey under Settings, then Security. If you have no codes left, ask your organization's owner.
Can we require two-step verification for everyone?
Yes. Under Settings, then Security, require it for everyone or for high-risk actions. Organizations using single sign-on can also rely on their identity provider's own checks.
Does Naarvin hold a security certification?
Not today. Our security page lists what is in place and what is on the roadmap, and we answer security questionnaires item by item.