# Account security: two-step sign-in and the audit log

Source: https://frosvo.com/docs/security
Updated: 2026-10-22

Turn on authenticator-app sign-in with backup codes, get alerts for new devices, sign in with Google or Microsoft, and review who did what in the audit log.

## Two-step sign-in

Turn it on in **Settings → Account → Two-step sign-in**:

1. Press **Set up** and scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, 1Password, Authy and others work. (Or type the key shown.)
2. Enter the 6-digit code the app shows.
3. **Save your 10 backup codes** somewhere safe. Each works once if your phone isn't to hand.

From then on, signing in — with a password, Google, Microsoft or a password-reset link — also asks for a code.

**Lost your phone?** Sign in with a backup code, then turn two-step off and on again to set up the new phone. If you've lost your backup codes too, ask an owner to contact Frosvo support.

## Sign-in alerts

We email you when your account is signed in to from a device we haven't seen before, when a backup code is used, and when your password or two-step settings change. If it wasn't you, change your password and turn on two-step sign-in.

## Google and Microsoft

You can sign up and sign in with Google or Microsoft. If you already have an account with the same email, it's linked — as long as Google or Microsoft confirms you own that address.

## The audit log (owners)

**Settings → Security** shows who did what: sign-ins, security changes, the team, API keys, integrations, privacy and billing — including anything Frosvo support did while helping you. Filter it, or export it as CSV. Entries are kept for 400 days.

Owners are also emailed about important changes: someone made an owner, two-step turned off, a new API key or webhook, the workspace handed over, and whenever Frosvo support opens your workspace.

## Good habits

- Turn on two-step sign-in for every owner.
- Store the ten backup codes in a password manager.
- Review the audit log monthly for changes you do not recognise.

For single sign-on across a company, see [single sign-on](/docs/single-sign-on). Give people the access they need with [roles](/docs/roles-and-permissions), and read how your data is handled in [your data](/docs/privacy).

## Common questions

### I lost my phone. Can I still sign in?

Yes. Use a backup code, then turn two-step off and on again to set up the new phone.

### How long is the audit log kept?

Entries are kept for 400 days. You can filter it or export it as CSV.

### Do I get warned about new devices?

Yes. We email you when your account is signed in on a device we have not seen before.