Account security

Sign-in is passwordless: a link to your inbox or Continue with Google, and optionally a second factor. Everything you can change about that, and about the devices signed in to your account, is in Settings under Security.

Two-factor authentication

Two-factor authentication is optional: once it is on, every sign-in also asks for a six-digit code from an authenticator app. Enable it in Settings and scan the code with the app — Google Authenticator, 1Password, Authy and Bitwarden all work. You confirm the enrolment by typing the first six-digit code.

What it protects is the gap a magic link leaves. Clicking the link proves you hold the mailbox and nothing else; with an authenticator enrolled, the link alone no longer reaches the app. Sign-in stops at /verify-2fa until a code clears.

That wall is checked on every entry to the app, not once when the link is clicked. Navigating straight to a page inside the app does not step around it, and there is no option to remember a device — a device is not a second factor, so it cannot stand in for one.

Disabling two-factor authentication asks for a fresh code from the authenticator you are removing, and signs out every other session as it completes.

Recovery codes

You get ten codes, each three groups of four characters. They are generated in your browser and shown once, with Copy and Download buttons — Trepeat stores only their hashes and cannot show them again.

They are set before you first reach the app, not when you enable two-factor authentication, and enabling it later does not replace them. They are the account-recovery factor for the whole account, which is why they exist even if you never enrol an authenticator.

• Each code is single-use. Settings shows how many of the ten are unused, warns below four, and warns harder at zero.
• Regenerating replaces the whole set. Any unused codes from the old set stop working. It requires a fresh authenticator code, or — if you have no authenticator — one unused code from the current set. All other sessions are signed out once you confirm you have saved the new ones.
• A code is the only way past the sign-in wall. Redeeming one at /verify-2fa also removes every enrolled authenticator in the same step, so you re-enrol afterwards if you want the factor back.

Actions that ask you to confirm again

Some actions ask for a six-digit code typed in the last five minutes, even though you are already signed in, and the check runs on the server: the dialog is how you are asked, not what decides. Sessions are not time-boxed, so being at two-factor level only proves a code was typed at some point — it cannot authorise something irreversible weeks later.

• Deleting your Trepeat account.
• Opening the billing portal, adding a card, adding paid accounts, switching to yearly billing straight away, or starting your subscription before the trial ends.
• Changing your sign-in email.
• Changing or removing your backup email.

Regenerating recovery codes is checked on the server as well: it needs an authenticator code typed in the last 5 minutes, or an unused recovery code. If yours is older by the time you confirm, Settings asks once for a fresh one. Disabling two-factor authentication also asks for a code, but that check runs in the browser: the server requires only that your session is at two-factor level. Switching to yearly at your next bill charges nothing and asks for no code.

If you have no authenticator enrolled there is no second factor to re-confirm, so deleting the account and the billing actions proceed directly. Regenerating codes and changing the sign-in email still ask, and accept an unused recovery code instead. No codes left? Turn on two-factor authentication in Security, then use your authenticator there. Paid accounts and the trial are covered in pricing and the free trial.

A new authenticator is not enough on its own for 24 hours. Adding an authenticator asks for no code, so for its first day, changing your sign-in email and regenerating recovery codes ask for one of your unused recovery codes as well as the six-digit code. Without that, anyone holding a signed-in session could add an authenticator of their own and use it to take the account. If you have no unused codes left you are not asked. Whenever an authenticator is added we email your sign-in address, with how to remove one you did not add.

Your backup email follows the same rule with two differences. Setting your first one does not ask at all. And without an authenticator, changing or removing it proceeds directly rather than asking for a recovery code — there is no second factor to challenge, and a prompt that verified nothing would only look like protection. With an authenticator, the code is checked by the server like the actions above, and resending a pending change's confirmation link asks for it again. Keeping the address current matters: it is the channel account recovery uses.

Active sessions

The Active sessions panel lists every device currently signed in, each row showing the browser and system read from its user agent, the IP it connected from, and when it was last active. It refreshes while the tab is open, so a sign-in elsewhere appears without reloading.

Sign out one row, or use Sign out all other sessions to clear everything except the one you are using. Signing out the session you are on returns you to the sign-in page. Nothing expires on a timer, so sessions accumulate until they are signed out — past five, the panel shows the count and scrolls.

Below it, Recent activity is the full security-event history for your account — sign-ins, factor changes, code regenerations, session revocations — loaded ten at a time as you scroll, and updated across your other open tabs as events land.

What Trepeat holds for a broker connection

A MetaTrader account is stored as its number, its server name, and its trading password held encrypted in the database vault. The password is never shown again after you enter it and is used only to open the broker connection. Deleting the account removes the stored credential with it. See Connecting a MetaTrader account.

cTrader holds no password at all. You authorise Trepeat on cTrader's own site, and the authorisation that comes back is what is encrypted and kept — against the cTrader ID rather than against a single account, because one authorisation can cover several. Withdrawing it in cTrader ends Trepeat's access, and deleting your Trepeat account destroys it too. See Connecting a cTrader account.