Cablefolio

Accounts, security, and data

Accounts and security

Updated

Your own profile, password, second factor, and signed-in devices, what each role may do, and — for an owner or admin — how accounts are managed.

Edit your profile

  1. Press your picture or name in the header, then Profile.
  2. Under About you, change your Display name, Title, Phone, or Email, and press Save profile.
  3. Under Picture, press Choose a picture (or Change picture) to add a photo of yourself; Remove picture takes it off.

Change your password

  1. On Profile, go to Password.
  2. Type your Current password, then a New password and Confirm new password. It needs at least 12 characters, and cannot be your username, digits alone, or a common word.
  3. Press Change password.

Reset a forgotten password

On the sign-in page, press Forgot your password?, type your Username, and press Send the link. If the account has an email address, a link arrives that works for 60 minutes.

Turn on a second factor

A second factor asks for a six-digit code from an authenticator app after your password.

  1. Open Settings, then Security.
  2. Under Second factor, press Add an authenticator app.
  3. Scan the QR code with your authenticator app, or type the Secret into it.
  4. Type the Code from the app and press Turn on.
  5. Write down or copy the recovery codes shown, then press I have saved these. Each code signs you in once if your phone is lost. They are not shown again.

The section then reads On, with how many recovery codes are left. New recovery codes issues a fresh set (the old ones stop working). Turn off asks for your password and a code.

When you sign in, enter the code from the app and press Continue. Without your phone, press Use a recovery code instead.

Sign out other devices

Security also lists Signed-in devices, with when each signed in and was last active; yours is marked This device.

  • End session signs out one device.
  • Sign out everywhere else signs out every device but this one.

Do this at once if a phone or laptop is lost or stolen.

Who can do what

  • Owner: everything an admin can do. The owner account cannot be removed, and only the owner can hand ownership to another account.
  • Admin: manages accounts and webhooks, sets report branding, archives clients and properties, deletes anything, removes items from the recycle bin for good, reveals stored credentials and access codes, makes share links and one-time links, asks clients for logins and accepts or rejects what they send, manages checklist templates, and re-opens a signed-off checklist or work order.
  • User: adds and edits anything, but cannot delete a client or a property. Sees that credentials and access codes are stored but cannot reveal them.
  • Client: a customer's own sign-in to the portal, limited to one client. See The client portal.

Any account can be Limited to one client. A limited account sees that client only: search, the Resources tables and their downloads, and the dashboard cover that client's records alone, and the accounts page, the audit log, and webhooks are closed to it. The owner is never limited: to make a limited account the owner, set its Limited to to Every client first.

Send a login once

When someone outside the team needs one stored login — a subcontractor, or the client themselves — send it by a one-time link instead of reading it out or emailing it. An owner or admin can do this.

  1. On the client's page, find the entry in Vault (or, for a device's own login, open the device and find Credentials).
  2. Press Send once.
  3. Give it a Label saying who it is for, and choose when it expires in Expires in (days) — a day unless you change it, 7 days at most.
  4. Press Make the link, then copy the address with the copy button and send it. It is shown only this once.

The person who opens the link sees a page that asks first; only when they press Show the login does it show the username and password — never the entry's notes or one-time-code seed — and from then on the link shows nothing. Preview bots in chat apps and email only fetch the first page, so they cannot use it up. One-time links on the client's page lists where each link went and whether it was opened, revoked, or expired; press Revoke on one still waiting to close it.

Ask a client for a login

Instead of asking a client to read out their ISP or Wi-Fi login, ask their portal account for it. An owner or admin can do this, for a client with a portal account (see The client portal).

  1. On the client's page, in Credential requests, press Ask the client.
  2. In What you need, name the login — the answer is filed in the vault under this name — and choose its Category.
  3. Add a Note to the client saying where they will find it, and press Ask the client.

The client sees the request in the portal and answers it there. What they send is encrypted the moment it arrives and appears in Vault marked Submitted — review: reveal it to check it, then press Accept into the vault in Credential requests to keep it, or Reject to delete it for good. Cancel request withdraws one nobody has answered yet.

Manage accounts

An owner or admin opens Settings, then Accounts.

  1. Press Add account.
  2. Fill in the Username, Email, Role, and Limited to.
  3. Type a First password, or press Generate a password — a generated one stays visible so you can pass it on.
  4. Press Add account.

The accounts are listed under People. Each account's row carries Edit and Exposure report; the rest of what you may do to it is under More actions: Set password, Sign out everywhere, Remove second factor, API tokens, for the owner Make owner on a staff account that sees every client (never a client account, and not a limited one), and Remove, last. Nobody can change or remove the owner's account from here. The same page has Export data (the whole map as one JSON file, never passwords, credentials, or the photos themselves), Revoke every share link, and the Audit log, which records sign-ins, account changes, exports, and every reveal of a device's credentials, a property's access codes, or a vault entry.

API tokens

A personal API token lets a script or another system read (or read and write) the map as you, without your password. Open Settings, then API tokens, press Create token, give it a Name, an Access level, and an expiry in Expires in, and copy the token straight away — it is shown once. A token can do what you can, except sign in or out; change your own password, sessions, or second factor, or remove anyone's second factor; list, create, or revoke tokens; reveal or change device credentials, access codes, or vault entries; rotate the credential key; or manage share links, one-time links, or credential requests. What a script can ask for is described in the API reference, also under Settings.