Account security & two-step verification
Signing in, two-step verification and recovery codes: what to do, and what to do if you lose your phone.
Your FunnelRover account opens your organisation's data. This page explains how it is protected, and what you need to do.
Who must turn on two-step verification?
Two-step verification is mandatory for Admins of an organisation: at their first sign-in, the platform takes them there before any other page. Other users (MaDa, members) can turn it on if they wish, from their account page.
Turning on two-step verification
- Install an authenticator app on your phone if you do not have one: Google Authenticator or Microsoft Authenticator.
- Scan the QR code FunnelRover shows with that app. It adds a "FunnelRover" entry displaying a 6-digit code that changes every 30 seconds.
- Type that code into FunnelRover to confirm.
- Store your recovery codes: FunnelRover gives you ten. Each one lets you sign in once if you no longer have your phone.
From then on, every sign-in asks for your password, then for the code shown by the app.
Where to keep recovery codes
- Yes: in a password manager, or on paper, kept with your important documents.
- No: on the phone itself (screenshot, note) — you would lose them together; nor in an e-mail or an unencrypted file.
A recovery code works only once. If you have used several, or they may have been seen, generate new ones from your account page: the old ones stop working.
Never share the QR code
The QR code, and the "authenticator secret" written under it, can produce your 6-digit codes. Show them to no one, do not photograph them, do not send them. If it happens, ask the platform administrator to reset your two-step verification: you will scan a new QR code.
Changing phones, or losing yours
- New phone, old one still in hand: some apps transfer their accounts (Microsoft Authenticator, Google Authenticator with Google account sync). Otherwise, ask for a reset.
- Lost phone: sign in with a recovery code, then ask for your two-step verification to be reset.
- Phone and recovery codes both lost: contact the platform administrator, who will check your identity before resetting access.
Good habits
- A long password used only for FunnelRover, never reused elsewhere.
- Sign out on a shared device: the platform then clears what it kept in the browser.
- FunnelRover will never ask for your password or a code by e-mail, phone or WhatsApp.