Account security

Two-factor authentication, deactivating your account, transferring an organisation you own, and deleting one. All of it lives in the web app - Settings → Security for your account, Organisation → Danger zone for the organisation - and none of it can be done with an access token or an AI agent: those are the credentials it protects.

Access tokens and devices

Create and revoke access tokens in Settings → Access tokens, and sign other devices out in Settings → Sessions, from the web app. An access token can list both but change neither. Creating a token, or changing your email address, needs a verified email address first. If you mistyped your address when you signed up, sign up again with the right one.

Resetting or changing your password makes every older password-reset link stop working.

If someone signed up with your address before you did and never verified it, signing in with Google or GitHub takes the account back: their password, two-factor, tokens, sessions and pending links are all removed.

Two-factor authentication

Two-factor adds a second step to signing in with your email and password: a six-digit code from an authenticator app on your phone, such as Google Authenticator, 1Password or Authy.

Turning it on

1. Settings → Security → Two-factor authentication → Turn on.
2. Scan the QR code with your authenticator app, or type the key shown under it.
3. Enter the six-digit code the app now shows, and your password, to prove it works. Two-factor is only switched on once a code has been accepted, so a mis-scanned QR code can never lock you out.
4. Save your ten recovery codes. They are shown once. Each one signs you in a single time if you lose your phone - there is no support desk that can let you back in without them.

You get an email whenever two-factor is turned on or off.

Signing in

After your email and password, you are asked for the current code from your app. A code works once: if you are asked again straight away, wait for the next one. Lost your phone? Choose Use a recovery code and type one of your saved codes; spaces, dashes and capitals do not matter. Each recovery code works once, and using one sends you an email saying how many you have left.

Signing in with Google or GitHub never asks for a code. Those providers already protect your account with their own second step, so Nothing Left does not add another.

Five wrong codes in a row end the attempt, and you start again from your password. More wrong codes pause sign-in for 15 minutes.

New recovery codes, and turning it off

• Create new recovery codes when you have used several, or think someone has seen them. The old ones stop working at once.
• Turn off two-factor with your password and a code - from the app, or a recovery code.

An account that only ever signs in with Google or GitHub has no password, so there is nothing for two-factor to protect; set a password first if you want it.

Confirming important changes

Turning off two-factor, creating new recovery codes, deactivating your account, and deleting or handing over an organisation all ask you to confirm:

• with your password, plus a code if two-factor is on;
• or, if your account has no password, by signing in with Google or GitHub again - the change then goes through within the next ten minutes.

Deactivating your account

Settings → Security → Danger zone → Deactivate account. Deactivating:

• signs you out everywhere and revokes every access token, so connected agents and scripts stop working;
• keeps your memberships and everything you wrote, under your real name. Colleagues see your name greyed out, and you are no longer offered as an assignee or in mentions;
• sends you a confirmation email;
• starts a six-month clock. After six months your personal data is erased, as described under Erasing your data, and the account cannot be reactivated.

If you own an organisation, you cannot deactivate your account until you transfer ownership or the organisation is deleted - someone has to be able to look after it.

To reactivate, email admin@nothingleft.dev (or reply to the deactivation email) from the address on the account within six months of deactivating. On a self-hosted instance, write to the address its administrator gives. Your memberships come back as they were; sign in again and create new access tokens.

Erasing your data

Deactivation keeps your name on your work. Six months after you deactivate, your personal data is erased automatically. To have it erased sooner, email admin@nothingleft.dev - you, or an Org Admin of your organisation on your behalf. Erasure replaces your name with Deleted user, and removes your email address, photo, password, sign-in links, last sign-in IP address and recent searches. What you wrote in issues and comments is not rewritten.

Transferring ownership

Every organisation has one Owner, who alone can delete it or hand it over. To hand it over, the Owner goes to Organisation → Danger zone → Transfer ownership, picks a member and confirms. Any active member with a verified email can receive it.

For example, Alex Lee owns ACME and offers it to Casey Kim:

• Casey gets an email with a link to accept or decline, valid for 7 days; Alex gets a note that the offer went out.
• Until Casey accepts, Alex is still the Owner and can cancel the offer. Making a new offer replaces the old one.
• When Casey accepts, Casey becomes the Owner and Alex stays an Org Admin. Both get an email, and the audit log records the transfer.
• If Casey declines, Alex hears so and nothing changes.

The link only works for the person it was sent to: signed in as anyone else, it says so.

Deleting an organisation

Only the Owner can delete an organisation: Organisation → Danger zone → Delete organisation, then confirm.

• Deletion is scheduled, not immediate. There are 14 days before anything is removed, and every member sees a banner with the date. Everyone can keep working meanwhile.
• The Owner and every Org Admin get an email when it is scheduled, a reminder one day before, and another when it is done.
• The Owner can cancel at any time during the 14 days; the admins are told, and nothing is lost. A pending ownership transfer is cancelled when deletion is scheduled, and none can be started until it is cancelled.
• After 14 days the organisation’s projects, issues, comments, articles and files are deleted, and nobody can open it any more. Files kept in your own connected bucket are never touched. Members’ accounts, and their other organisations, are unaffected.
• The organisation’s address - acme in X-Organization: acme - stays reserved, so it can never be taken by someone else.