Security of Credentials

1. Your credentials

Your credentials are your account number, your password, the authenticator app set up for your account, your recovery codes, and any CodeNav Account you link to the desk account. Together they are how the company knows that an action on the desk is yours.

2. What you undertake

You will choose a password you do not use anywhere else, and keep it secret.

You will keep the authenticator on a device that only you control, and you will not copy its secret to anyone else's device.

You will keep your recovery codes somewhere safe and private, and treat each as you would your password.

You will not let anyone else sign in as you or act through your account, even someone you trust, and even on your instructions.

You will sign out when you finish on a device that others use, and keep the devices you use for the desk locked and up to date.

3. If your credentials may be known

You will tell the company at once, by email to director@codenav.dev, if you think anyone else knows your password, has your recovery codes, or can reach your authenticator, or if you see activity on your account that was not yours. The company may then suspend the account and issue you new credentials.

Until you tell the company, an action taken with your credentials is treated as taken by you.

4. What the company does

The company stores your password only in a form from which it cannot be read back, keeps the authenticator secret and your identity document number encrypted, locks an account after repeated failed attempts, and records every sign-in.

The company will never ask you for your password, an authenticator code or a recovery code by email, telephone or message. Anyone who does is not the company.