Account Security: Passwords, Two-Factor Authentication, and Devices

Overview

Every account on Dermi Atlas Professional is a team member account, and its username, password, two-factor authentication, and signed-in devices belong to the individual member. They are managed on the Account page, opened from Options => Account in the sidebar, which also holds the member's name and username, edited in place and applied with Save Changes. The password is set on the practice's computer and never leaves it.

The Dermi Cloud Services account used in the Dermi Portal has its own settings, covered in Managing the Dermi Cloud Services Account.

Password Requirements

A password must:

• Be between 12 and 256 characters long
• Include an uppercase and a lowercase letter
• Include at least one number
• Include at least one special character from the accepted set ! @ # $ % ^ & * ( ) - _ = + { } ; : , < . > ?. Other symbols are not accepted.

The requirements apply when an invitation is claimed, when the password is changed, and when it is reset.

Two-Factor Authentication

Two-factor authentication adds a code from an authenticator app to every sign-in.

Turning On Two-Factor Authentication

1. On the Account page, find Two-Factor Authentication under Security & Authentication and select Request Enable.
2. Open the setup link. It is emailed to the account's verified address, and it is also listed under the Verifications icon in Dermi Atlas Manager.
3. On the Set Up 2FA page, scan the code with an authenticator app, such as Google Authenticator, Authy, or 1Password.
4. Enter the code from the app and select Verify and Enable 2FA.
5. Save the recovery codes with Save to File or the copy control, and keep them somewhere safe. They allow signing in if the authenticator device is lost.
6. Select Sign In. Turning on two-factor authentication ends the current session and every trusted device, so the next sign-in asks for a code.

Illustrative demo with synthetic data. Learn more

Signing In with Two-Factor Authentication

After the username and password are accepted, the sign-in continues to Enter Authentication Code. Enter the current code from the authenticator app and select Verify.

Selecting Skip 2FA for routine logins on that step makes the device a trusted device: for the next 30 days, signing in on it asks for the username and password only. Trusted devices are cleared when two-factor authentication is turned on, when the password is changed or reset, and by Sign Out Everywhere. Signing a device out from Signed-In Devices also clears its trust.

Illustrative demo with synthetic data. Learn more

Signing In with a Recovery Code

When the authenticator device is unavailable, Need help? on the authentication code step reveals Use recovery code, which switches the step to Enter Recovery Code. Ten recovery codes are issued when two-factor authentication is turned on, and each works once.

Illustrative demo with synthetic data. Learn more

Turning Off Two-Factor Authentication

Select Request Disable under Two-Factor Authentication on the Account page. The link opens the Confirm 2FA Removal page, which takes a current authenticator code and Disable 2FA.

Illustrative demo with synthetic data. Learn more

Changing the Password

1. On the Account page, select Request Change under Password.
2. Open the link, which is emailed to the verified address and listed under the Verifications icon in Atlas Manager.
3. On the Change Your Password page, enter the New Password and select Update Password.

Updating the password signs the account out on every device and clears every trusted device, so the next sign-in uses the new password.

Forgotten Password or Username

Forgot your login? on the sign-in page opens the Recover Account page. Enter the account's email address and select Recover Account. A recovery link is emailed to the address together with the username; when the address is not verified, the confirmation reports that the link has been created, and it is opened from the Verifications icon in Atlas Manager. The link expires after one hour and opens the Change Your Password page described above.

Illustrative demo with synthetic data. Learn more

Illustrative demo with synthetic data. Learn more

Verified Email Addresses

Verification links and security email are sent only to a verified address. An address is verified when the invitation sent to it is claimed. While an address is unverified, the Account page shows an Email Not Verified notice, and every link is opened from the Verifications icon in Atlas Manager instead. To verify it, the license owner selects Verify Address under Change Member in the Dermi Portal, and the member enters the emailed code on the Changes from the Dermi Portal card of their Account page, as described in Claiming a Team Invitation.

Signed-In Devices

The Signed-In Devices card under Security & Authentication lists every device the account is signed in on. Each row names the device, such as Safari on macOS or Atlas Companion on iPad, the network address it connected from, and when it was last active; the device in use is listed first with the This Device chip.

• Sign Out on a row ends that device's session and clears its trust, so signing in there again asks for an authenticator code while two-factor authentication is on.
• Sign Out Everywhere at the bottom of the card ends every session, including the current one, and clears every trusted device. Use it if unauthorized access is suspected.

A device signed out with Sign Out in the sidebar leaves the list at once. A device closed without signing out stays listed until its session expires after a period of inactivity.

Security Notifications

Notification Settings under Notifications & Activity sets which account emails the member receives:

• All Activity: a notification for every successful sign-in, plus the essential security alerts.
• Essential Only: only critical security alerts, such as a sign-in from a new device or a change to the account.

Deleting the Account

Delete Account is in the more options menu in the Account page header. Type REQUEST ACCOUNT DELETION to confirm and select Request Deletion. The link that follows arrives like the other account links, and it opens the Delete Your Account page, where typing DELETE ACCOUNT and selecting Confirm Deletion completes it. The profile and the member's access are removed, and patient records and the activity log stay with the team.

When Sign-In Is Refused

A correct username and password are also refused when the account has been disabled in Atlas Manager or its membership has ended in the Dermi Portal. The sign-in page names the reason and who to contact; each message and its remedy are listed in Troubleshooting Account and Authentication Issues.