Security & accounts
Authentication, 2FA, sessions, privacy, and the security log.
Sign-in & authentication#
Chatasist handles authentication with email + password, password reset, and email verification. Login is rate-limited (5 attempts/min per email + IP).
Forgot your password? Tap Forgot Password? on the sign-in screen — on the web app or in the iOS / Android apps — to receive a reset link by email. The link works the same way regardless of where you started the request: open it on a phone with the Chatasist app installed and it lands directly inside the app on a "Set a new password" screen; open it on a desktop browser and it goes to app.chatasist.com/reset-password.
Two-factor authentication (2FA)#
Time-based one-time passwords (TOTP) with recovery codes. Enabling 2FA requires confirmation, and 2FA challenges are themselves rate-limited.
On mobile: you can set up two-factor authentication in the Chatasist iOS / Android app under Profile → Account → Two-factor authentication. Scan the QR code with your authenticator app (Google Authenticator, 1Password, Authy, or any TOTP app), then save your recovery codes somewhere safe — each one lets you sign in once if you lose access to your authenticator. Once it's on, signing in on the app asks for your 6-digit code (or a recovery code) after your password, just like the web app.
Bot protection#
Sensitive auth actions (login, forgot/reset password, 2FA challenge, set password) can be protected by a bot-protection challenge (CAPTCHA). It's configurable per action and off by default.
Google sign-in#
Sign in with Continue with Google — on the web app and natively in the iOS / Android apps. The first time you continue with Google, we create your account from your Google profile (or sign you straight in if you've used Google before). If you already have a Chatasist account with a password, you'll be asked to confirm that password once to link Google to it — after that, Google sign-in just works. Manage linked identities under connected accounts.
Signing in with Google is available on every plan — it's a sign-in method, not a paid feature. New to Chatasist? After your first Google sign-in on the mobile app, you'll be prompted to create or join a workspace before you reach your inbox.
Account management#
From their account, each user can:
- Update profile, change password, and change email (with confirmation).
- View and revoke active sessions (one or all others).
- Set notification preferences, presence (online / away / busy / offline), and Do-Not-Disturb hours.
- Export their data or deactivate the account.
Security activity log#
Security-relevant events are logged per user — including login, logout, failed login, password changes/resets, email changes, 2FA enable/disable, API token create/revoke, social account link/unlink, session revocation, and account deactivation. A subset of these also sends a security-alert email.
Onboarding#
New users get a guided tutorial (progress is tracked, and it can be skipped) plus onboarding email nudges — for example, reminders to send a first reply or connect a first channel.
In-app, email, and Slack notifications.