Account Security
Understand how Orchard72 protects your account with multiple layers of security, and learn what to do if your account is compromised.
Last reviewed
How We Protect Your Account
Your Orchard72 account is protected by multiple layers of security designed to prevent unauthorised access even if your email is compromised:
- Multi-factor authentication (MFA): verify your identity with a second method
- Password reset cancellation: cancel a reset you did not request while its link is still valid, for one hour after the request
- Cooling-off periods: time-delayed security changes give you time to respond
- Recovery key: a master key for account recovery when all else fails
- Security event notifications: get alerted about suspicious activity instantly
- Account freezing: pause high-risk actions on a compromised account right away, then fully lock it (signed in: immediately; from the public form: via an emailed confirmation link)
Recovery Key
A recovery key is a special code that allows you to recover your account if you lose access to both your email and all MFA methods. Unlike backup codes (which are single-use codes for MFA bypass), a recovery key is your last resort for full account recovery.
How to generate a recovery key
- Go to Settings > Security
- Find the Recovery Key section
- Click "Generate Key" (or "Regenerate" if you already have one)
- Save the key securely, as it will not be shown again
- Confirm you have saved it by checking the acknowledgement box
Where to store your recovery key
- A password manager (recommended)
- A secure physical location (e.g. a safe)
- A printed copy stored separately from your devices
- Never store it in your email, because if your email is compromised the key would be too
What to Do If Your Account Is Compromised
If you suspect someone has gained unauthorised access to your account, act immediately:
- Report your account as compromised, which pauses high-risk actions immediately
- Open the confirmation link we email you to fully freeze the account and end all sessions
- Change your email password (the email linked to your Orchard72 account)
- Review your recent sign-in activity for suspicious sessions
- Contact our security team for further assistance
When Account Changes Are Paused
Choosing “This wasn’t me” in a security alert email, or reporting your account as compromised from the public form without signing in, pauses changes to your account. It is a protective pause rather than a full freeze: you can still sign in and see everything, and a banner on your account pages tells you when the pause lifts. (If you report the account while you are signed in, it is fully frozen straight away instead and every session ends.)
How the pause ends
- It lifts on its own at most 48 hours after it started
- It ends straight away when you reset your password using the link we email you
- It also ends when a completed account recovery puts your new password in place
- Whichever way it ends, we email you to say the pause has lifted and why
What you can still do while paused
- Sign in and view your information
- Remove a device you do not recognise
- Sign out of all your other devices
- Reset your password from the emailed link, or contact support
Every other change waits until the pause lifts, not just the examples here. That includes changing your password from Settings, changing your email address or phone number, adding or removing a sign-in method, editing your wills, estate or payment details, and downloading or exporting your data.
About the confirmation email
If the pause started from a report made without signing in, we also email a confirmation link to the account’s address. Opening it fully freezes the account and ends every session. If you did not make that report, you do not need to open it: reset your password instead to lift the pause. A pause started from a security alert email has no confirmation link, because you have already confirmed it yourself.
Cooling-Off Period
When certain sensitive account changes are made (such as password resets or account recovery), a cooling-off period is activated. During this time, some account modifications are temporarily restricted.
This protects you because it gives you time to notice and cancel changes you did not authorise. If an attacker resets your password, you have time to cancel the reset before they can make further changes.
What happens during cooling-off
- You can still sign in and use your account normally
- Password changes, email changes, and MFA modifications are restricted
- You will see a banner on your dashboard and settings pages
- A password reset starts a 48-hour cooling-off period; account recovery starts a 72-hour one
- You can cancel the triggering action while its cancellation link is still valid: one hour for a password reset, the full 72 hours for account recovery
Security Event Notifications
Orchard72 sends notifications for important security events so you can respond quickly if something is wrong:
- Password reset requests: with a link to cancel if you did not request it
- New device sign-ins: alerts when a new device accesses your account
- MFA method changes: when authentication methods are added or removed
- Account recovery attempts: with a link to cancel if you did not initiate it
- Account freeze confirmations: when your account is frozen for security
These notifications are sent to your registered email address and, where configured, via SMS. We recommend keeping your contact details up to date.
Related Resources
Can’t find what you’re looking for?
Our support team is here to help. Contact us and we’ll get back to you as soon as possible.
Contact Support