# Account security What you find under Desk → Account → Security and how to use it: your password and Google sign-in, your email address, two-factor authentication, signed-in browsers and recent sign-ins, the computers running the app, the confirmations asked before sensitive steps, and closing your account. ## Where to find it Open the Desk at https://relay2trade.com/control, then Account → "Security". The tile shows "Two-factor on" or "Two-factor off". The line at the top of the screen sums up the account: whether two-factor is on, the ways you sign in (for example "Password + Google") and how many browsers are signed in. The screen holds these cards: "Two-factor authentication", "Sign-in methods", "Computers running the app", "Active sessions" and "Recent sign-ins". Tap a card's title to open or fold it. ## Your password Under "Sign-in methods", "Password" reads "set" or "not set: you sign in with Google". To change it: 1. Press "Change password". "To change your password we email you a link to a page where you pick the new one." 2. Open "Reset your password" in the email within 60 minutes and press "Choose a new password". 3. Type the "New password" twice and press "Change password". A password needs at least 12 characters, without your name, your email or "Relay2Trade", and one that does not appear in known data breaches. It cannot be your current password or one of your last five. Changing the password signs the desktop app out on the computer where it runs, so it stops reading signals until it is signed in again. Sign it back in from "Computers running the app" (see below). Other browsers stay signed in until their current session ends: use "Sign out all other devices" to sign them out at once. An account that signs in only with Google has "Set a password": "We emailed you a link to set your password." ## Google sign-in Under "Sign-in methods", "Google" reads "connected" with the Google address, or "not connected". - "Connect Google" takes you to Google and back. "That Google account is already connected to another Relay2Trade account." means that Google account belongs to another login. - "Disconnect" removes it after you confirm it is you. It is offered only while your account has a password, so you can still sign in without Google. Otherwise: "Set a password first, so you can still sign in without Google." - Each change is emailed to you: "Google sign-in was connected to your account" or "Google sign-in was removed from your account". While Google is connected, "Confirm it is you" asks you to confirm with Google. ## Your email address Account → "Your details" → "Email": "The address you sign in with. To change it, write to us in Support." More about your details and your data: https://relay2trade.com/help/your-account-and-data.md. ## Two-factor authentication Two-factor is optional. It adds a 6-digit code from an authenticator app on your phone (Google Authenticator, Authy, 1Password and similar). With it on, the code is asked when you sign in with your password, and with your password whenever the Desk asks you to confirm it is you (turning two-factor off, making new recovery codes, deleting the account and the other steps listed below). An account with Google connected confirms those steps with Google instead. Approving signals, closing trades, changing settings and the other Desk actions ask for no code. ### Turning it on 1. Open "Two-factor authentication" and press "Enable two-factor". 2. Scan the QR code with your authenticator app. "Can't scan? Enter this key manually:" shows the key to type instead. 3. Type the "6-digit code" the app shows and press "Confirm & turn on". 4. Save the 8 recovery codes: "Save these recovery codes somewhere safe — each works once if you lose your authenticator. Shown only now." Use "Copy all" or "Download as a file". "Cancel setup" drops a setup you have not confirmed. Two-factor can also be set up in the app on Windows, on its account panel ("Set up two-factor"). ### Managing it - "Regenerate recovery codes": "Your current codes will stop working immediately." You confirm it is you first. - "Turn off": you confirm it is you, then two-factor is off. You get the email "Two-factor authentication turned off", with "This wasn't me" in case it was not you. Keep the recovery codes apart from your phone. A recovery code works once in place of an authenticator code. Without the authenticator and without the codes, you cannot sign in with your password on your own: write to support. ## Active sessions and Recent sign-ins - **"Active sessions"**: "Devices currently signed in to your account." Each row says whether it is the "Website" or the "Desk", and "this device" marks the one you are using. "Sign out" signs one device out and cancels its "remember me". "Sign out all other devices" asks "Sign out everywhere except this device?" A device signed out this way sees "You were signed out — this session was revoked." - **"Recent sign-ins"**: the last sign-ins with where they came from: "Account opened", "Signed in" and "App signed in" (shown as "Relay2Trade app"). "One you don't recognise is the moment to change your password and sign out the other devices." ### New-device emails and "This wasn't me" When your account is signed in to from a new device you get "New sign-in to your account", with the device, the IP address and the time. If it was you, nothing needs doing. "This wasn't me" is in that email and in the other security emails. One press, with no sign-in needed: - signs out every device, including the desktop app, and cancels "remember me" everywhere; - makes your old password stop working; - emails you "Your account was secured: set a new password", with a link that works for 60 minutes and once. Two-factor stays as it was: its code is still asked when you sign in with your password. ## Computers running the app This card lists each computer the app has signed in from, with its system, the app's version, when it first signed in and when its app was last heard. Its state is one of: - "running the app": the computer your app is signed in on. Its buttons are "Restart the app" and "Sign it out". Under it, "Application" holds the app's own switches on that computer ("Launch at startup", "Start minimized in tray", "Keep running when window closes", "Show tips", "Log level"); an app with no window shows only "Log level". - "app closed": signed in, but the app is closed there or the computer is off, so nothing is traded. Opening the app there carries on by itself. Its button is "Sign it out". - "asks to sign in": it used a one-time code. Press "Accept" or "Decline". - "signed in, waiting for the app": approved from here and not picked up yet. "Take the approval back" cancels it. - "signed out": with when and why. "Sign it back in" or "Remove" (takes it off the list; if the app there is opened again, it signs in as on a new computer). A VPS created for you is marked "VPS" and has "Stop it", "Start it", "Remove it" and, when it was put away, "Bring it back". A VPS in your own DigitalOcean account has "See it at DigitalOcean" and "Destroy this VPS". "Run it on a VPS" opens "Where the app runs". More: https://relay2trade.com/help/computers-and-moving.md and https://relay2trade.com/help/vps-setup.md. ## Confirmations before sensitive steps ### "Confirm it is you" These steps open a window that says what the step does and asks you to confirm it is you: your password, plus the authenticator code when two-factor is on; or Google, when Google is connected ("Confirm with Google", after which you have 10 minutes to finish). - "Restart the app": "Restart the app on that computer? Open trades stay in MetaTrader." - "Sign it out": "Sign the app out on that computer? It stops there until it is signed back in; open trades stay in MetaTrader." - "Remove" for a signed-out computer: "Take this computer off the list? If the app on it is opened again, it signs in as on a new computer." - "Sign it back in" for a signed-out computer. - "Make a code" (a one-time code for a Windows computer or VPS) and "Show the command" (the Linux command). - For the VPS created for you: "Stop it" ("It trades nothing until you start it again. Trades already open stay open in MetaTrader."), "Remove it" ("The app and its MetaTrader on it are deleted for good.") and "Run it on the VPS" (the app moves there and is signed out on your other computer). - "Regenerate recovery codes", "Turn off" for two-factor, and "Disconnect" for Google. - "Delete my account". "Start it" for a stopped VPS asks nothing more, and neither do "Accept" and "Decline" for a computer asking to sign in. "Destroy this VPS" opens "Destroy your VPS at DigitalOcean?"; DigitalOcean may ask for your approval for that step. ### Plain confirmations Other steps ask a short question first, for example "Sign out of the Desk on this device? Its notifications stop here too.", "Log MetaTrader out? This profile stops trading until it logs in again.", "Log Telegram out? This profile stops reading its groups until it logs in again.", "Close this trade?", "Close every trade of this profile?", "Stop opening new trades on this profile?" and "Remove this listener? Its signals stay in your history." Switching a listener to Auto asks you to tick "I understand that orders will be placed on my account automatically, and that the results are my responsibility." before "Turn on auto". ## Closing your account Before you close it, you can download what is kept about your account: Account → "Your details" → "Your data" → "Download my data". 1. Open Account → "Your details" → "Delete account". 2. Read what it means: "Your account is closed for good and signed out everywhere. A plan that is running ends at once, and nothing is given back for the days left. Open trades stay at your broker with their own stop-loss and take-profit." 3. Press "Delete my account" and confirm it is you: "Confirm it is you. This cannot be undone." - A VPS created for you: "Your VPS is removed with your account, with everything on it." - A VPS in your own DigitalOcean account: it keeps running, and DigitalOcean keeps charging you for it, until it is destroyed. The Desk offers "Destroy it first"; if you keep it, destroy it at DigitalOcean when you no longer want it. - Invoices already issued are kept, as the law requires. What is kept, what you can download and what closing removes: https://relay2trade.com/help/your-account-and-data.md. ## If something goes wrong - **Your authenticator codes are refused.** Set the phone's date and time to automatic. Each code works once, so wait for the next one after a refusal. - **You lost the phone with your authenticator.** Sign in with a recovery code (type it in "Code" where the sign-in asks for the authenticator code), then turn two-factor off and on again with the new phone. Without the codes, write to support. - **"This account has no password to confirm with in the app. Turn two-factor off on relay2trade.com (Account → Security), where you confirm with Google."** Do it in the Desk, where Google confirms it is you. - **"That is not the Google account connected to your account."** Confirm with the Google account shown under "Sign-in methods". - **"Set a password first, so you can still sign in without Google."** Press "Set a password", set it from the email, then disconnect Google. - **You got "New sign-in to your account" and it was you.** Nothing to do: it comes for a new browser or a new network. - **You pressed "This wasn't me" by mistake.** Set a new password with the link in "Your account was secured", sign in again and sign the app back in under "Computers running the app". - **A computer asks to sign in and you made no code.** Press "Decline", change your password and use "Sign out all other devices". - **The app stopped trading after a password change.** It was signed out. Press "Sign it back in" on that computer under "Computers running the app".