Help Center › Account & Billing › Profile & security
Profile & security
Update your personal information, change your password, and enable two-factor authentication to protect your account.
Profile settings
Your profile controls how your name and photo appear throughout Asan CRM — in team views, email signatures, and Cori's greetings.
- Go to Settings → Profile.
- Update your name, email, and phone number as needed.
- Upload a profile photo. Click the avatar area and select an image. Supported formats: JPG, PNG (max 2 MB).
- Click Save.
Changing your email address requires re-verification. A confirmation link is sent to the new address — your email does not change until you click it.
Changing your password
- Go to Settings → Password.
- Enter your current password to verify your identity.
- Enter and confirm your new password. Use at least 8 characters with a mix of letters, numbers, and symbols.
- Click Update Password.
Use a password manager to generate and store a strong, unique password. Avoid reusing passwords from other services.
Two-factor authentication (2FA)
Two-factor authentication adds a second layer of security. After entering your password, you must also provide a 6-digit code from an authenticator app.
- Go to Settings → Security.
- Click Enable Two-Factor Authentication.
- Scan the QR code with Google Authenticator, Authy, 1Password, or any TOTP-compatible app.
- Enter the 6-digit code from the app to confirm setup.
- Save your recovery codes (see below).
Once enabled, every login requires both your password and a fresh 6-digit code from your authenticator app.
Do not skip saving your recovery codes. If you lose access to your authenticator app without recovery codes, you will need to contact support to regain access.
Recovery codes
When you enable 2FA, Asan generates 8 one-time recovery codes. Each code can be used exactly once in place of your authenticator code if you lose access to your device.
- Store them securely — in a password manager, printed on paper in a safe location, or in an encrypted file. Do not store them in plain text on your device.
- Each code works once. After use, it is permanently invalidated.
- Regenerate codes at any time from Settings → Security. This invalidates all previous codes and generates a fresh set of 8.
Periodically check how many recovery codes you have remaining. If you are running low, regenerate a new set from Settings → Security.
Suspicious login protection
Asan monitors login activity for unusual patterns. When a login attempt comes from a new device or unfamiliar location, additional verification is required:
- Email verification. A one-time code is sent to your registered email address. Enter it to confirm the login.
- Login notifications. You receive an email alert whenever a new device or location is detected, even if the login succeeds.
- Session management. View all active sessions in Settings → Security. Revoke any session you do not recognize by clicking Log Out next to it.
Using a VPN may trigger location-based verification, since your apparent location changes. This is expected behavior and a sign that the protection is working.
Frequently asked
I lost my authenticator device. How do I log in?+
Use one of your recovery codes in place of the 6-digit authenticator code. If you have no recovery codes remaining, contact support with your account email for identity verification and manual 2FA reset.
Can I disable 2FA after enabling it?+
Yes. Go to Settings → Security and click Disable Two-Factor Authentication. You will need to enter a current authenticator code or recovery code to confirm.
Which authenticator apps are supported?+
Any app that supports the TOTP (Time-based One-Time Password) standard: Google Authenticator, Authy, 1Password, Microsoft Authenticator, Duo Mobile, and others.
How do I update my email address?+
Go to Settings → Profile, enter the new email, and click Save. A verification link is sent to the new address. Your email does not change until you click the link.
Can my admin see my login history?+
Account administrators can see login timestamps and IP addresses for team members in the admin panel. They cannot see passwords or authenticator codes.
Was this article helpful?
Thanks — we'll use this to make the docs better.
Last updated 16 Jun 2026 · Applies to: Asan CRM