Signing in & security

How accounts are created, the ways you can sign in, and the security features that protect your account and your data.

Creating an account

Depending on how your organisation set Finblade up, accounts are created in one of three ways:

• Single sign-on. Press Continue with Microsoft or Continue with Google on the login page. If your company domain is registered, your account is created on first sign-in and placed in your organisation.
• Invitation / directory sync. Your administrator creates the account (or it is provisioned from the company directory). Sign in with the method they gave you.
• Sign up. Press Sign up on the login page, enter your name, work email, mobile number and a password. You then:
  1. Verify your email — enter the 6-digit code sent to your inbox (codes expire after 10 minutes; use Resend verification code if needed).
  2. Optionally verify your mobile number with an SMS code.
  3. On some deployments, wait for an administrator to activate the account — the login page tells you if this is the case.

A promo code entered at sign-up activates the account immediately.

Ways to sign in

Enter your work email first; the next step depends on what your account has.

Method	Where to enable	Notes
Password	Sign-up, or Set Password in Profile → Security (SSO accounts)	Followed by a two-factor code when enabled
Authenticator app (two-factor)	Set up when prompted at sign-in, or from Profile → Security	Any TOTP app (Microsoft Authenticator, Google Authenticator, 1Password…). Scan the QR code, then enter the 6-digit code
Passkey	Profile → Security → Set up passkey	Face ID, Touch ID, Windows Hello or a hardware key. Up to 5 per account — add one per device
Microsoft	Automatically for organisations with Microsoft SSO; link from Profile → Security
Google	Link from Profile → Security	Requires a verified Google address

You can hold several methods at once and use whichever suits the device you are on. Finblade will not let you remove your last sign-in method — add another before removing one.

Sessions

• A sign-in lasts up to 90 days on a device, staying signed in as you use the app; after 90 days you sign in again.
• Each device or browser has its own session. To sign out everywhere at once — for example after losing a phone — use Log out from all devices in the profile menu.
• Log out in the same menu signs out the current device only.

Forgotten password

On the login page choose Forgot password?. You will need your recovery code (see below) and the email address of the account. Set a new password; your encrypted chats stay readable because the recovery code unlocks them.

If you have lost the recovery code as well, contact your administrator: they can reset your sign-in, but chats encrypted before the reset cannot be recovered.

Recovery code

Every account has a recovery code. It is emailed to you automatically when the account is created, and you can request a fresh one from Profile → Security → Recovery Code → Email a new code (the previous code stops working).

Keep it somewhere safe. It is the only way to reset a forgotten password without losing encrypted chat history, and Finblade will never ask you for it.

Encrypted chats

Chat AI conversations are end-to-end encrypted: messages are encrypted in your browser with a key derived from your password (or unlocked by your passkey or SSO identity) before they are stored. The server keeps ciphertext it cannot read. Consequences worth knowing:

• Changing your password re-wraps your key automatically.
• Signing in with a new method (a passkey, a linked Google account) also binds that method to your key, so it can unlock your history.
• Messages you or an integration store through the API without the key are kept in plain text until the next time you sign in, when the app encrypts them.

Profile → Security

Section	What you can do
Change password / Set password	Update your password, or add one to an SSO-only account so both methods work
Two-factor authentication	Set up or remove the authenticator app
Passkeys	Add a passkey for this device, name it, see when each was last used, remove one
Connected accounts	Link or unlink Microsoft and Google. "Sign-in only, won't unlock chat" means the provider can sign you in but is not bound to your encryption key yet — confirm your password once to bind it
Recovery code	Email yourself a new code
Delete account	Permanently delete the account and all its data (type DELETE to confirm). This cancels subscriptions and cannot be undone

Good practice

• Add a passkey on the devices you use daily — it is the fastest and safest way in.
• Turn on two-factor authentication if your organisation has not enforced it.
• Never share your recovery code or paste it into a chat.
• If you use the API, treat access tokens like passwords and prefer a dedicated service user for automations.