Two-factor authentication

Two-factor authentication (2FA) adds a second step to login. After entering your password, you also enter a code: a 6-digit code from an authenticator app on your phone, or a code CaseFlow emails you. This means even if someone gets your password, they still cannot access your account.

Setting up 2FA

1. Log in to CaseFlow and go to your profile (click your name in the top left, then Edit Profile)
2. Scroll to the Two-Factor Authentication section
3. Choose Enable Authenticator App
4. CaseFlow shows a QR code
5. Open your authenticator app (Google Authenticator, Authy, 1Password, etc.) and scan the QR code
6. The app starts generating 6-digit codes that change every 30 seconds
7. Enter the current code in CaseFlow to verify it works
8. Click Save

2FA is now active on your account.

If you would rather not use an app, choose Enable Email Two Factor Authentication instead: each time you sign in, CaseFlow emails a code to your sign-in address. An emailed code works for one hour.

Logging in with 2FA

1. Enter your email and password as normal
2. CaseFlow shows a second screen asking for your 6-digit code
3. Open your authenticator app, find the CaseFlow entry, and enter the current code
4. Click Verify

If the code is correct, you are logged in. If not, try the next code (they rotate every 30 seconds).

Each code signs you in once. A code that has already been used is refused, even inside its 30 seconds, so a code someone sees or intercepts cannot be used again; if you need to sign in again straight away, wait for the app's next code. An emailed code is used up the same way.

Wrong codes are counted for each account, apart from wrong passwords. After 5 code attempts for one account that do not end in a completed sign-in, that account's codes are refused for 15 minutes, wherever they are typed, and the next one tried ends the sign-in, so whoever was guessing has to start again with the password. Only someone who already has the password reaches the code step, so nobody else can use this to lock you out, and one person's mistyped codes never hold up colleagues signing in from the same office. The same applies to the client portal. See Data privacy for how sign-in attempts are counted.

What 2FA also unlocks

With 2FA turned on, the Keep me signed in option on the sign-in page becomes available to you, which trusts the device you are using for 7 days so you do not retype your password every morning. Without 2FA, ticking that box does nothing except tell you where to turn 2FA on.

This is deliberate rather than an incentive: skipping the password for a week makes the browser profile on that machine the only thing between someone and your client files, which is only a reasonable trade when a second factor is also in play. See Automatic sign-out.

Before enabling 2FA

CaseFlow does not generate one-time backup codes. Before you turn 2FA on, make sure you have your authenticator app set up on a device you will not lose, preferably with the authenticator account backed up through the app's own sync (Authy cloud backup, Google account sync, 1Password vault, etc.).

If your phone is lost or reset, recovering access depends on that backup; there is no emergency code you can keep in a drawer.

Disabling 2FA

Go to your profile, scroll to Two-Factor Authentication, choose Disabled and click Save. After disabling, login requires only your password.

Who controls 2FA

Each staff member sets up their own 2FA, and the firm administrator cannot see whether a specific staff member has it enabled.

A firm administrator can, however, require it. In Setup → Settings → Security, turning on Require two-factor authentication for team members means anyone who has not set it up is sent to their profile to do so on their next sign-in, and cannot get to the rest of CaseFlow until they have. There is a matching setting for client-portal contacts. CaseFlow support cannot change either setting.

Turning either requirement on or off is recorded in your audit log, showing who changed it and when. So is each team member turning their own 2FA on, off, or to a different method. A team member's authenticator app is saved only once CaseFlow has checked a code from it.

Locked out

If your firm's first administrator (the earliest administrator added who is still active) loses their phone and their authenticator app is not backed up anywhere, contact CaseFlow support. The support team can verify their identity and switch 2FA off on that one account, so they can sign in and set it up again. The change is recorded in your audit log as made by CaseFlow Support. Support can only switch 2FA off: it cannot turn it on or choose an authenticator app for anyone.

For anyone else at the firm, there is no way back in yet: CaseFlow support cannot switch their 2FA off, and a firm administrator cannot reset another team member's 2FA from within CaseFlow. Keep your authenticator app backed up (most apps offer this), or use email codes.

Authenticator apps

Any TOTP-compatible authenticator app works:

• Google Authenticator (iOS, Android)
• Authy (iOS, Android, Desktop)
• 1Password (built-in authenticator)
• Microsoft Authenticator
• Bitwarden (built-in authenticator)

CaseFlow does not send codes by text message: codes come from an authenticator app or by email.