The account that can see every fee ledger in your institute is usually protected by one password, typed on a shared office computer, and often known to more than one person. That is the single weakest point in most institutes we set up, and it is now fixable in about ten minutes.

What two-step sign-in does

With it on, signing in takes a password and a six-digit code from an authenticator app on the person's own phone. Someone who learns the password still cannot get in, because the code changes every thirty seconds and lives only on that phone.

It is the same mechanism your bank and your email already use. There is no hardware to buy and no SMS charge: the code is generated on the device, offline.

Turning it on

Each person enables it for their own account, in Profile → Security:

  1. Install an authenticator app — Google Authenticator, Microsoft Authenticator, Authy and 1Password all work.
  2. Open Profile → Security in Classfold and start the setup. A QR code appears.
  3. Scan the QR code with the app, then type the six-digit code it shows back into Classfold to confirm. The setup is not complete until that code verifies, so a mis-scan cannot lock anyone out.
  4. Save the recovery codes. Classfold shows a set of one-time codes at the end. Each one signs the account in once, without the phone. Print them and put them where you keep the institute's other important paper.

Classfold emails the account holder when two-step sign-in is turned on, turned off, or when the recovery codes are replaced, so an unexpected change is visible rather than silent.

Who should have it

In order of how much damage a stolen login would do:

  • The accountant, and anyone else with the finance module. This login can see and alter money records.
  • The administrator or principal account, which can change staff permissions — including the accountant's.
  • Anyone who can export. An export leaves the building. A login that can download the student list is worth protecting even if it cannot edit anything.
  • Teachers, last. The exposure is smaller, but the habit is worth having.

When a phone is lost

Use one of the recovery codes to sign in, then replace the set — rotating the codes invalidates every old one, so a printed sheet that went missing stops working. If the codes are gone too, an administrator can disable two-step sign-in for that account so the person can set it up again on the new phone.

The honest caveat

Two-step sign-in protects the sign-in. It does nothing about a password written on a sticky note under the keyboard, an account shared between three clerks, or a staff member who keeps access after leaving. Those are office habits, and the permission map is the tool for the last one: give each person the modules their job needs and remove the account the day they leave.

Start with the accountant. It is the one that matters most, and it takes ten minutes.