Groundbase

Account & security

Password

Change at Settings → Account & billing → Change password. Requires your current password (so a stolen session can't lock you out).

If you forget your password, hit Forgot password on the login screen — we email you a one-time reset link valid for 1 hour.

Login email

Change your login email at Settings → Account & billing → Login email → Change email (in the mobile app, Account → Change login email). Enter the new address and your current password, plus your authenticator code or a recovery code if two-factor is on. We email a confirmation link to the new address, and your login email changes only when you click it. The link works once, for 24 hours; asking again replaces it. Your current address gets a heads-up at the same time: if you didn't ask for the change, reset your password, which cancels it. An admin address can't be changed here.

Once it changes, your old address gets a notice (so you'd know if it wasn't you), Stripe receipts go to the new address, and you stay signed in on every device. An address another Groundbase account already uses can't be taken.

Sessions

Signing in creates a session on the server tied to that device. Signing out ends that session immediately, and sessions expire on their own.

There's no per-device session list yet. If you think another device is compromised, change your password at Settings → Account & billing → Change password — that signs out every other device while keeping you signed in on the one you're holding. A full reset via Forgot password signs out everything, including your current device. A password change also disconnects your AI assistants (their keys and connections stop working); reconnect them in Settings → AI integrations.

Email verification

You can't sign in until your email is verified. The verification link in the welcome email expires after 24 hours; if it expires, request a new one from the sign-in screen.

Two-factor authentication (TOTP)

Turn on at Settings → Account & billing → Two-factor authentication → Enable. Walk through three steps:

  1. Scan the QR code with any authenticator app — Google Authenticator, 1Password, Authy, Microsoft Authenticator, Bitwarden, etc. (No QR-code scanner? Tap the otpauth:// URI on your phone, or paste the base32 secret into the app manually.)
  2. Enter the 6-digit code from your authenticator to confirm pairing.
  3. Save your 10 one-time recovery codes — they're displayed once. Each can be used exactly once to sign in if you lose the authenticator. Print them or paste them in your password manager.

After it's on, sign-in adds a second step asking for the current 6-digit code. Recovery codes work in place of the code if you ever get locked out (one-shot — they don't repeat).

To disable: the same card → Disable. Asks for either your current 6-digit code OR your account password — so if you've lost the authenticator AND your recovery codes, your account password is still a way out.

To rotate recovery codes (e.g. after using a few): Regenerate codes. Old codes stop working immediately; you get a fresh 10.

MFA is the same across web, desktop, and mobile — set up once, every app asks for the second factor on sign-in.

Data export

Anything we have, you can take. Settings → Backup & export → Export JSON produces one file with every record in your account. Details, including restore, are in Importing data.

Deleting your account

Settings → Backup & export → Danger zone → Delete my account, on web or desktop. It asks for your password, your authenticator code (or one of your recovery codes) if two-factor is on, and the word DELETE typed out.

It is immediate and there is no undo. Everything goes: contacts, companies, deals, messages, calls, invoices, and the Google Calendar and email connections you set up. Your subscription is cancelled at the same time. Your Twilio account and its phone numbers are not touched; they are yours, on your own Twilio account. Export first if you want a copy.

This is different from cancelling, which stops the billing and keeps your data. In the Android app it's under Account → Delete account.