How multi-factor authentication works.

Why we require it.

Multi-factor authentication, or MFA, means proving who you are with two things instead of one: something you know (your password) and something you have (your phone). Even if someone learned your password, they couldn't get into your vault without also having your phone.

For a product that holds your family's most important information, that second layer matters. We require MFA on every account.

How it works on every login.

1. You enter your email and password on the login page. As usual.
2. You're taken to the MFA code screen. At the same time, we send a 6-digit code by text to the phone number you registered when you signed up.
3. You enter the code. The code expires after a few minutes, so use it right away.
4. You're in. Your vault unlocks and you can use IvorySafe as normal.

The "remember this device" option.

When you enter your verification code, you'll see an option to trust the device you're using for 30 days. If you turn it on, you won't be asked for a code on that device for the next 30 days. After 30 days, you'll need to verify again.

This option is off by default, and we recommend leaving it that way. Skipping the code makes logging in faster, but it also removes a layer of protection. If your laptop is stolen, lost, or accessed by someone you didn't authorize, the protection you'd want is the one you turned off.

If you do use this option, only turn it on for devices that:

• Only you use
• Have their own screen lock or password
• Stay in your physical possession

Never trust a shared device, a public computer, or a device that anyone else might access.

If you don't receive your code.

Most missing codes show up within a minute or two. If yours hasn't:

1. Wait one full minute. Text delivery can be slower than you'd expect, especially during high-traffic times. Don't keep requesting new codes. That often makes the problem worse, since carriers may flag rapid repeated messages.
2. Check your phone's signal. If you have spotty service or Wi-Fi calling issues, the text may not have come through. Try moving to a spot with better signal.
3. Make sure the phone number on file is correct. The code goes to the number you registered with. If you've changed phones or carriers, the number on file may be outdated.
4. Check that you haven't blocked short-code messages. Verification codes come from a short code (a 5-6 digit sender ID). Some carriers and phones can be configured to block short codes. If that's been set up on your phone, you'll need to unblock them.
5. Request a new code. If you've waited and tried the above, request a new code from the login page. The old one expires once a new one is sent.

If you're outside the United States.

IvorySafe's MFA codes are sent by SMS to US phone numbers only. If you're traveling internationally, two things may happen:

• Your US number may still receive texts via roaming, depending on your carrier and plan. Many do.
• If your US number is forwarding to an international number, or if you've disabled roaming, the code may not reach you.

If you're traveling and worried about losing access, here are a few practical things to do before you leave:

• Confirm with your carrier that you'll receive texts at your US number while abroad
• Log in once before you leave and consider enabling the 30-day device trust on a device you'll have with you
• If you need to access your vault during the trip and can't receive a code, email support@ivorysafe.com ahead of time

We know this is a limitation. International SMS reliability is something we're working to improve.

Changing your phone number.

If you've changed phone numbers and your old number is the one on file for MFA, you may not be able to receive your code. Right now, updating your registered phone number isn't something you can do from your settings. Email support@ivorysafe.com and we'll help you update it.

Important: don't wait until you're locked out to update your number. If you know your number is changing, update it before your old number stops working.

Common questions.

Why SMS and not an authenticator app?

SMS is the most universally accessible option. Authenticator apps are more secure in some ways, but they also require users to install and set up an extra app, and recovery is hard if their phone is lost. For our launch product, we chose SMS because it works for everyone with a phone. Adding support for authenticator apps and passkeys is on our roadmap.

What if my phone is lost or my battery is dead?

If your battery is dead, charge your phone and try again. If your phone is misplaced but somewhere findable, take the time to find it.

If your phone is permanently lost, this is a real problem. Because we require a code sent to your registered phone number for every login, losing access to that phone means losing access to your vault. We can't bypass the verification step for you. If you've also lost the ability to get texts at your old number (for example, the phone is gone and you've switched to a new number on a new device), you can email support@ivorysafe.com and we can help you delete your account so you can start a fresh one. You will not be able to recover the data in your original vault.

This is exactly the reason we recommend keeping your phone number on your IvorySafe account up to date before you switch phones or carriers.

Can someone log in to my account without my phone?

In almost every case, no. Even if someone has your password, they can't get past the verification step without the code sent to your phone. The one exception is a device where you turned on "remember this device." On that device, and only until the 30 days are up, no code is required, so someone with your password and access to that specific device could get in. This is why it's worth only turning that option on for devices that stay in your control.

How long does each code stay valid?

A few minutes. If the code expires, just request a new one from the login page.

Will MFA also be required for emergency contacts?

Yes. MFA applies to every IvorySafe account, including free emergency contact accounts. The phone number you use during signup is the one that will receive codes.