Two-factor authentication (2FA, also called DFA or TFA) adds a second login step to ContractSafe, and you can enable it on all of our plans. An Admin turns it on for the whole account in Settings > Security and Integrations, and then each user sets it up the next time they log in, using an authenticator app or text message.
Enable two-factor authentication for the whole account (Admins)
- Go to Settings > Security and Integrations.
- Click the toggle button for Two Factor Authentication.
A "Setting Enabled" banner should then appear on the lower left of the screen, indicating that 2FA has been enabled for all users on the account.
Once this is enabled, ALL users will be automatically logged out for security purposes. Once they log in, the Two Factor Authentication setting page will appear. They won't be able to access ContractSafe until this setting is completed.
Set up two-factor authentication for the first time (all users)
Note: A smartphone with an active internet connection is required to continue.
Using an Authenticator App over Text message authentication (OTP) is HIGHLY recommended for security and reliability reasons.
Please reach out to your IT/Security Administrator for advice on what Authenticator app to use. We recommend using Google Authenticator if you're already on the Google ecosystem, and Microsoft Authenticator if your company uses Microsoft.
- In your browser, go to app.contractsafe.com.
- Log in using your login credentials. You'll then be prompted to set up two factor authentication.
- Select either of the two options and click Submit. In this example, the selected option is Authenticator App.
- A new screen will appear with a QR code visible.
- Open your smartphone and authenticator app, and select the option to add an account by scanning a QR Code.
- Aim your mobile camera at the QR code. The account should be automatically added with the label "app.contractsafe.com" or similar. A dynamic code is generated on the app and it changes every few seconds. (The code on the screenshot below is partially covered for security purposes.)
- Type the generated code into the ContractSafe website and click Submit.
- Finally, select whether to trust the device.
Note: Only choose Yes (trust this device) if you're using your own computer. Clicking "Not now" or "Never" will still allow you to log in, but will prompt you to type in a 2FA code again later on.
Set up two-factor authentication with a mobile number
Similar steps can be taken to set up 2FA using a mobile number. The only difference is that the code comes from a text message instead of an app.
ContractSafe recommends using an Authenticator App instead, as text message authentication (OTP) is vulnerable to various attacks, including SIM-swapping and phishing, where attackers can intercept authentication codes and gain unauthorized access to accounts.
Change or reset your 2FA method
To switch between an authenticator app and text messages, see How do I change my Dual-Factor Authentication (DFA) method? If you've lost access to your codes, here's how to reset two-factor authentication, and if you've forgotten your password, here's how to reset your password.
Please don't hesitate to reach out to support@contractsafe.com for further inquiries.