Account security and recovery
Sudo confirmation, signing out everywhere, the "Not me" button on a sign-in request, and how an administrator resets a member's two-factor authentication.
Brivio asks you to confirm it's you before sensitive actions, and gives you — and your organisation's administrators — safe ways out when a factor is lost or a password is compromised.
Confirming it's you ("sudo")
Before a sensitive account action (turning off two-factor, regenerating backup codes, deleting a passkey) Brivio asks you to confirm with a passkey, your authenticator app, a backup code or, for low-risk actions, your password. The confirmation lasts 5 minutes, only in the browser where you gave it.
The confirmation is recorded on our servers, so Settings › Security › Sign out all devices ends it immediately, together with every session — including in a browser someone else may have.
"Not me" on a sign-in request
When you use push approval, a sign-in on another device shows a request on your phone. If you did not start it, tap This wasn't me — report it. Someone typed your correct password, so Brivio:
- denies the request and signs your account out everywhere;
- locks password sign-in until you reset the password from Forgot password;
- forgets every "remembered" device and ends any confirmation in progress;
- sends you an email with the requesting IP address.
Passkeys and single sign-on (SSO) keep working, so you are never locked out of a factor the attacker does not hold. After the reset, sign in with the new password and review Settings › Security.
Signing in with Google when your organisation requires two-factor
Google sign-in proves your Google account, not a second factor, so in an organisation that requires two-factor authentication Brivio asks for one right after Google brings you back. You stay signed in — a Confirm it's you screen asks for:
- the 6-digit code from your authenticator app, or
- your passkey (Windows Hello, Touch ID, your phone) or a security key, or
- one of your backup codes.
If your account has no second factor yet, the same screen lets you add one on the spot — a passkey or an authenticator app — and then takes you into the app. Nothing is skipped: the organisation's requirement is met only once a factor has actually been verified on our servers.
Platform staff
Brivio staff accounts with platform roles hold their powers only on a session where a second factor was presented (passkey, authenticator app, backup code or push approval). A password-only or Google session — or a "remembered" device that skipped the second factor — is asked for the factor on the Confirm it's you screen.
When a member loses their second factor
If a member lost their phone and has no backup codes left, an owner or administrator can reset their second factor from Settings › Team (the key icon next to the member). The reset is deliberately not immediate:
| Step | What happens |
|---|---|
| Request | The administrator confirms with their own second factor, states a reason and picks a waiting period of 24, 48 or 72 hours. The member receives an email at every verified address. |
| Waiting period | The member sees a banner in Settings › Team and can cancel the reset. Any administrator can cancel it too. |
| Completion | After the waiting period an administrator confirms again with their second factor. The member's authenticator app, backup codes, passkeys, remembered devices and push devices are removed, and all their sessions end. |
| Payment hold | For 72 hours after completion, a factor the member enrols cannot authorise payments, exchanges, new beneficiaries or payment rules. |
Only an owner can reset another owner's factor, and nobody can reset their own from this screen. Every step appears in the organisation's audit log and in the member's Security activity.
Organisation authentication policy
Owners and administrators set it in Settings › Security › Authentication policy. Every change asks you to confirm with your second factor and is recorded in the organisation's audit log.
| Setting | Effect |
|---|---|
| Allowed sign-in methods | Members signed in with a method that is not allowed are asked to sign in again. You cannot remove the method you are signed in with. |
| Phishing-resistant confirmation | For payments and/or administration actions only a passkey is accepted; a password or an authenticator code is no longer enough. Members without a passkey are asked to add one. |
| Maximum session length / inactivity | Shorter than the platform limits (7 days / 12 hours). After the limit the member signs in again. |
| Allowed networks | IP addresses or CIDR ranges. Your current address must be in the list. An owner signed in with a passkey can still get in from outside it, so a wrong list can always be fixed. |
| Accept MFA done at the SSO provider | When on, a member who already passed two-step verification at Okta, Entra or another SAML/OIDC provider is not asked again by Brivio, as long as that verification is recent (60 minutes by default). It never counts as the highest level, which stays reserved for hardware security keys verified by Brivio. |
For each SSO connection the card shows what the last sign-in through it proved: whether the provider sent MFA evidence, and which level it would grant — so you can check before turning trust on. If your provider uses its own value for MFA (for example an Okta-specific authentication context), add it to the connection's list.
Confirming a payment
When you send a payment, approve or reject one, exchange currency or add a new beneficiary from Revolut Business, Brivio first shows a confirmation screen with the details exactly as they will be executed — amount, beneficiary, last four IBAN digits, reference and mode. Your confirmation applies to that operation only:
| You confirm with | What is bound |
|---|---|
| A passkey | Your device signs a fingerprint of the operation itself. If anything in it changed, the signature does not match and nothing is sent. |
| An authenticator code or re-authentication | The confirmation is accepted only for that one operation, and only if you gave it after the confirmation screen appeared. |
The confirmation screen is valid for 15 minutes. An approver confirms the payment as they saw it: if the payment changed in the meantime, the approval is refused and must be reviewed again. Operations prepared but never confirmed are listed under Unconfirmed operations on the payments page — nothing was sent to the bank for them. The operation fingerprint on the screen also appears in the audit log, so you can match a confirmation to its record.
Approving on your phone or computer
The Brivio app for Android and for Windows, macOS and Linux can approve your sign-ins and payments with a device key: a key created inside the device's secure hardware (StrongBox or the secure area on Android, the TPM chip on Windows, the system keychain on macOS and Linux) that never leaves it.
Setting it up. Open the app, go to Profile → Security → Approval devices and choose Use this device to approve sign-ins and payments. Brivio asks you to confirm it's you with a second factor first. The list shows every device, the kind of key it holds and when it was last used; remove a device there if you lose it. A badge says Hardware key, verified only when Brivio checked Google's attestation for an Android key — otherwise the device's claim is shown as not verified.
Approving a sign-in. When you sign in elsewhere, the phone receives a notification and the computer app shows one. Open it, check the time, device and address, and tap the number shown on the sign-in screen. Your device signs exactly that request — its number, the request's identifier and its expiry. The notification itself contains no number and no details, only a link.
Confirming a payment on your phone. On the payment confirmation screen choose Confirm on my phone. The phone shows the same amount, beneficiary and operation fingerprint, built from the copy stored on the server; tap the matching number and the device signs that operation. A phone confirmation is valid for 60 seconds.
Limits.
- At most three approval requests are sent in ten minutes.
- If you deny three requests within 15 minutes (a wrong number, This wasn't me or Report it), new requests are paused for one hour and you receive an email. Sign in with your authenticator code or a passkey in the meantime — and change your password, because someone else has it.
- An approval on a device counts as a strong second factor, but not as the highest level, which stays reserved for hardware security keys.
Passkeys in the Brivio apps
Android app. Passkeys work inside the app: signing in, adding a passkey and confirming an action use your Google Password Manager or the passkey provider you chose on the phone, exactly as in the browser. A passkey created on the phone also works on brivio.ro.
Windows, macOS and Linux app. The app signs you in through a browser window: use your passkey (or password and authenticator code) there, and the app opens already signed in. Passkeys you created in the browser therefore work for signing in to the app. The app itself cannot create or use a passkey, so Profile → Security shows where to add one instead of an Add passkey button. If you signed in with a second factor less than 15 minutes ago, the app session keeps that level; after that it counts as a plain sign-in until you confirm again.
Confirmations in the desktop app. When an action asks for your passkey, the app offers your authenticator code or a backup code instead. Where your organisation requires a passkey (for example for payments), approve it with Confirm on my phone if you have an approval device, or do it at brivio.ro in a browser.
Open the desktop app already signed in. On brivio.ro/downloads, while signed in, press Open Brivio signed in after the installer finishes. The app opens and shows the account it will use (Continue as …); nothing happens until you confirm. The link works once, for 10 minutes. If it expired or was already used, open the downloads page again or sign in with your email. Each link you create, each refused link and the sign-in itself appear under Security activity.
Signing out. Sign out in the account menu ends the session and returns to the sign-in screen — in the browser and in the apps. In the desktop app it also forgets the saved sign-in and clears the data kept for offline use, so the next launch asks you to sign in again.
Unusual sign-ins
Every sign-in — password, passkey, Google, Microsoft or another single sign-on provider — is checked against a fixed, published set of rules. This is not automated profiling or machine learning: each decision comes from a rule you can see, never from a hidden score.
| Rule | Triggers when |
|---|---|
| New device | The browser or device has not been seen on your account before. |
| New country | You have not signed in from that country before. |
| New network provider | The connection comes from an internet provider (ASN) new for your account. |
| Impossible travel | Two sign-ins are too far apart for the time between them — faster than about 900 km/h. Distances under 500 km are ignored. |
| Tor | The address is a Tor exit node. |
| Hosting network | The address belongs to a datacenter — cloud servers and many VPNs. |
| Failed attempts | A burst of wrong passwords on your account or from the same address. |
What happens. These signals alone never block you — Brivio asks for an extra check instead:
- With two-step verification on, you are asked for your second factor, even on a device you marked as trusted.
- Without it, we email a one-time code to your account address. It is valid for 10 minutes; enter it to continue. You also get an email whenever a new device signs in.
- A passkey sign-in is not asked for an extra check — the passkey already proves it is you, on your device.
- After Google or Microsoft sign-in you are asked for your second factor if you have one; otherwise you are signed in and alerted by email.
The only refusal. A sign-in is refused only when it comes through Tor and there is a burst of failed attempts at the same time — whatever the method. Wait, then sign in from your usual connection. If you did not cause the failed attempts, someone is trying your password: reset it from Forgot password.
Seeing why. Profile › Security activity lists every decision with its reasons, for example Extra check requested: new country (DE), new device or Sign-in refused (unusual activity). These records are kept for 180 days.
Platform administrators can tune the thresholds. While the checks are being rolled out they may run in observation mode: the signals are recorded, but no extra check is asked.
What you can do. Turn on two-step verification in Profile › Security, add a passkey (see Passkeys in the Brivio apps) or an approval device, and if you see a device you do not recognise, use Settings › Security › Sign out all devices and change your password.
Sessions bound to your device
On Chrome for Windows on a computer with a security chip (TPM), Brivio binds each sign-in to a key that lives in that chip and cannot be copied off the device (Device Bound Session Credentials). You do not need to do anything: it happens in the background after you sign in, and Profile › Devices shows the device as Device-bound.
What it protects. Malware that steals your browser cookies cannot use them to confirm sensitive actions — payments, deleting data, changing security settings or the admin console — from another computer. Without the chip's proof, Brivio asks you to confirm again with your passkey, authenticator code, backup code or password.
When you may be asked again. If your browser could not refresh the proof (for example the computer slept for a long time, or the chip was busy), a sensitive action asks you to confirm once more. That is expected; confirm and continue.
Other browsers. Firefox, Safari, Chrome on other systems and computers without a security chip work exactly as before — nothing changes for them.
Lost every sign-in factor (owners)
If you own an organisation in which nobody else is an owner or administrator, and you lost your authenticator, passkeys and backup codes, nobody can reset your second factor for you. Brivio lets you recover the account by proving your identity again — it must be the same person who verified their identity before.
Before you need it. Verify your identity once in Settings › Identity while you can still sign in. Recovery compares the new check with that one; an account that was never verified (or verified before 14 October 2026) cannot use it and must contact support.
| Step | What happens |
|---|---|
| Start | Sign in with your email and password, and on the second-factor step choose Lost all your sign-in factors? |
| Identity check | Verify your identity with an ID document and a selfie (Stripe Identity) or, where available, with the EU Digital Identity Wallet. The result must match the identity you verified before. |
| Waiting period | 72 hours. We email every verified address with a cancel link that works without signing in. If it was not you, one click stops it. |
| Completion | After the waiting period, sign in with your password and choose Check status. Your authenticator, backup codes, passkeys, remembered devices and push devices are removed and every session ends; set up a new factor straight away. |
| Payment hold | For 72 hours after completion a new factor cannot authorise payments, exchanges, new beneficiaries or payment rules. |
If your organisation has another administrator, ask them instead — see When a member loses their second factor. A check that does not match changes nothing, and every step appears in Profile › Security activity.
Brivio does not keep your name or date of birth from the check: it keeps only a one-way fingerprint computed with a server key, which can say "same person" but cannot be turned back into the data.
EU Digital Identity Wallet
Where the national wallet is available, Settings › Identity offers EU Digital Identity Wallet. Brivio asks the wallet only for your family name, given names and date of birth (your personal identification data, PID), and you approve the request in the wallet.
- On the same device: if your browser supports digital credentials, choose Use the wallet on this device.
- From your phone: scan the QR code with the wallet app, or tap Open in wallet app on the phone.
Brivio checks that the data was issued by a recognised PID provider and was presented by your wallet for this request only. The verification counts as the highest identity level. The Romanian wallet is not yet public; the option appears when it is.