Course 3 · Your account and security

Welcome back to the Academy. This course puts your account in your hands, sign in, security, and inbox.

Lesson one. By the end of it you can keep your profile current and rotate your password without help. Everything lives on one settings page.

Your name, title, and timezone sit at the top. The timezone sets the dates on every digest you receive.

Changing your email is deliberate. You confirm your current password, and nothing switches until you click the link sent to the new address.

Follow the vendors you buy from. They shape your weekly report and your vendor alerts.

A new password is checked against known breaches before it is accepted, and every other session signs out the moment it changes.

Lesson two. Here you enroll two factor authentication and learn the way back in if you lose the device. It is the highest value step you control.

Two factor registers a rotating six digit code from an authenticator app against your account. Once it is on, that code becomes your sign in. A stolen password stops being enough.

Setup is three moves. Scan the code with any authenticator app, Google Authenticator, 1Password, or Authy. Enter the six digits to confirm. Then save your backup codes somewhere real, because each one is a single use way in when the phone is gone. The count remaining is shown.

If you lose the device, sign in with an emailed link, choose a recovery code at the prompt, and use one backup code. Each works once. Then register the new device. Active sessions shows every place you are signed in, one action signs out the rest.

Sign in history is your answer to was that me. Every device, first seen, last active, and the IP address. A device you have never used triggers the new device email. An entry you do not recognize means change your password, which signs out every other session.

Owners can require two factor for every member. If your organization does, sign in holds new members at registration until it is on. That hold is the policy working, not a fault.

Lesson three. After it you can decide exactly what reaches your inbox. The rule here is respect. Nothing renewal shaped is sent until you ask for it.

One preference model governs every channel. A choice made here applies to the in app inbox, push, and email together. One decision, every surface.

Renewal alerts start off on every channel. When you want them, one press on turn on money critical alerts switches the whole set on at once.

The weekly briefings are three vendor intelligence emails, price lists, licensing news, and new research. Each is strictly opt in with a one click unsubscribe.

Guidance emails sit behind one switch. Turning it off never touches invites, security notices, or the reports you asked for.

Your weekly email arrives as one Monday brief with four sections, the market wire, renewals coming up, watchtower changes, and savings. Keep the sections you read, turn off the rest.

Lesson four, two minutes on where your data lives. The trust center states the controls so you can answer a security reviewer directly.

Three commitments carry the page. Kept apart, kept sealed, and kept yours. Isolation, encryption and access, then audit and deletion.

Kept apart means the separation is enforced at the database itself, not in the screens. Your rows answer only to your organization, whoever asks.

Access follows least privilege. People and systems get the narrowest access their job requires, and contract files live in private storage behind short lived links.

Roles match clearance, an owner can do what a member cannot. When a reviewer asks how your data is protected, send them this page.

Now you. Enroll your authenticator, three minutes. Two questions. Where are your backup codes? What arrives uninvited? Nothing. Next, Course 4, the dashboard and the Desk.