How your account stays yours
Intersink gives every User ID the same sign-in protections, free of charge: passkeys, 2-step verification, new-device checks, lockouts after repeated wrong passwords and alerts when something changes. Businesses can then make the strongest options compulsory for their team.
Start with a passkey
A passkey replaces your password with your fingerprint, your face or your device’s screen lock. It is tied to our website, so a look-alike page cannot trick you into handing it over. You can add passkeys under Security, then Passkeys, and remove any you no longer use.
If you prefer a password, choose something long rather than complicated. A phrase of four unrelated words beats eight random characters. You can change it at any time under Security, then Change password.
- Passkeys
Sign in with a fingerprint, face or screen lock. Nothing to type, nothing to phish.
- Passwords, if you want one
Change it whenever you like. We ask for something long.
- Breached-password check
New passwords are checked against lists of passwords exposed in data breaches, without your password ever being sent anywhere.
- A human check
Forms that could be abused, such as sign-up and password reset, ask you to prove you are human.
- Confirm it’s you
Sensitive changes, such as removing a passkey or turning off 2-step, ask for your passkey or password again, even when you are signed in.
- Recovery email and phone
Used only for security and account recovery, never for marketing.
A second thing only you have
After your password, Intersink asks for something only you have. It stops almost every account takeover.
Authenticator app
Any standard authenticator app works. Scan the code on screen, then type the 6 digit code it shows.
Recovery codes
Ten single-use codes for when you cannot use your phone or passkeys. Keep them offline, printed or in a password manager.
Text message codes
Available if you want them, but an authenticator app or a passkey is safer, because text messages can be intercepted.
We check, then we tell you
- New-device confirmation
Signing in from a device we have not seen before asks you to confirm it is really you.
- Lockout after wrong passwords
After 5 wrong passwords, sign-in for that account is locked for 15 minutes. This protects you if someone is guessing.
- Slow down
Too many attempts in a short time are paused, so automated guessing gets nowhere.
- Sign-in alerts
Tell you when a new device signs in or after several wrong passwords. Alerts for a password change, 2-step being turned off, a passkey being removed or your data being exported are always sent.
- Devices and sessions
See every device signed in to your User ID and sign out anything you do not recognise.
- Security activity
Sign-ins, failed and blocked attempts, and every change to how you sign in, kept for 180 days.
Rules for everyone in your business
Owners set sign-in rules under Security and privacy in the business. They apply the next time each person signs in.
| Rule | What it does |
|---|---|
| Require 2-step verification | Members without it are asked to set it up before they can open the business. |
| Allow passkeys | On by default. Faster to use and resistant to phishing. |
| Allow text message codes as 2-step | Off by default, because text messages can be intercepted. |
| Only allow admins from approved IP addresses | Useful for office networks. Owners are never locked out. |
| Sign members out after | A period of inactivity on every device: 12 hours, 7 days or 30 days. |
Protection for your website and app
Every channel has a Protection page that keeps bots, spam and attackers away from its website, app and API without getting in the way of real customers. Intersink’s own network defences are always on; the settings on that page tune them for one channel.
- Bot protection
Standard challenges visitors only when their behaviour looks automated. Strict also challenges anyone arriving from a data centre or VPN.
- Spam and forms
A human check on sign-up and contact forms, a hidden trap field, and the option to hold reviews that contain links.
- Blocklist
Block an address or a client that keeps causing trouble, and remove it again later.
- Events
A running list of what was blocked, challenged or held, and why.
When our staff open your data
Sometimes a support request can only be answered by looking at your workspace. The business audit log records the reviews and verification steps Intersink staff take on your business, and you can see them under Audit log, filtered by Support. Other staff access to your data isn't recorded there yet. We are adding a step where staff must ask for access against a ticket, and the log will then show the ticket, what was opened and for how long.