Security rules and limits
This page is the reference for every rule of account access. The rules are the same in the Business panel and in the Personal app.
Password
| Rule | |
|---|---|
| Length | At least 12 characters |
| Numbers | At least 1 (0-9) |
| Lowercase | At least 1 (a-z) |
| Uppercase | At least 1 (A-Z) |
| Upper and lower case | Passwords are case-sensitive |
Codes
Every code has 6 digits.
| Code | Arrives by | Works for | On the 5th wrong attempt |
|---|---|---|---|
| Email confirmation at sign-up | 15 minutes | The sign-up is cancelled. Fill in the form again | |
| Mobile confirmation at sign-up | SMS | 10 minutes | The code stops working. Ask for another SMS, if you still have one |
| Sign-in | Authenticator app | 30 seconds, once | The sign-in is cancelled. Type the password again |
| Password reset | 10 minutes, once | The code stops working. Ask for a new one | |
| Authenticator replacement | Email, then the new app | 15 minutes for each | The replacement is cancelled. Start again from the password |
When you ask for a new code by email, the previous one stops working.
SMS
SMS is used once in the life of an account: to confirm the mobile number at sign-up.
| Limit | Value |
|---|---|
| Time between one SMS and the next | 60 seconds |
| SMS per sign-up | 3. Changing the number uses one of them |
| SMS to the same number | 3 every 24 hours, counted from the first one |
When a limit is reached, the screen asks you to try again later. If the 3 SMS of a sign-up are used up, that sign-up cannot be finished: start again from the form.
Mobile number
- The number is stored in the international format, with the country code.
- It has 8 to 15 digits, counting the country code.
- Choose the country from the list, or Other country to type the full number.
- A zero in front of the local number is removed automatically.
- The number confirmed at sign-up cannot be changed.
Time to finish each flow
| Flow | Time |
|---|---|
| Sign-up, counted from the email confirmation | 60 minutes |
| Sign-in, between the password and the authenticator code | 5 minutes |
| Authenticator replacement | 15 minutes for the email code, then 15 minutes to set up the new app |
When the time runs out, the flow starts again from the beginning.
Sessions
| Default duration | 1 day |
| With Stay signed in for 7 days | 7 days |
| First session, right after sign-up | 1 day |
| Sign out | Ends the session right away |
| Password changed | Ends every session of the account |
| Authenticator replaced | Ends every session of the account |
| Platform update | May end the session. Sign in again |
A session is valid only where it was created. A session of the Business panel does not work in a Personal app, and a session in one company's app does not work in another company's app.
One account per email and per number
| Business panel | Personal app | |
|---|---|---|
| One account in the whole panel | One account in each company's app | |
| Mobile number | One account in the whole panel | One account in each company's app |
Too many attempts
The platform limits how many times sign-in, codes and sign-up can be tried in a short period from the same network. When the limit is reached, the screen shows Too many attempts. Wait a few minutes and try again.
What the platform never does
- It never sends a link by email. Every email brings a 6-digit code that you type on the site you already have open, or it is only a notice. If you receive an email with a link to sign in or to change a password, it did not come from the platform.
- It never asks for your password or your codes by email, by phone or by chat.
- It never shows your authenticator key again after the setup screen.
- It never sends SMS after sign-up.
Emails you may receive
Every email is in English. The sender is the name of the company whose app you use. In the Business panel the sender is Web3Card. The subject starts with that same name.
| Subject ends with | When | What it brings |
|---|---|---|
| Confirm your email | You create an account, or ask for a new code | A code that works for 15 minutes |
| Code to reset your password | You select Forgot password? | A code that works for 10 minutes, once |
| Code to change your authenticator app | You select I lost my phone | A code that works for 15 minutes |
| Your password was changed | The password of the account was changed | A notice, without a code |
| Your authenticator app was changed | The authenticator of the account was replaced | A notice, without a code |
The SMS has one line: the name of the company, the code and how long it works.
If an email does not arrive, check your spam folder and ask for a new code. If you receive a notice for something you did not do, contact support right away.
Messages on the access screens
When you fill in a field
| Message | When it appears | What to do |
|---|---|---|
| Enter a valid email address. | The email does not have the format of an email address | Fix the address |
| Enter your password. | Sign-in with the password empty | Type the password |
| The password does not meet the rules below. | One of the four password rules is missing | Look at the rules that are not green yet |
| Enter the name of your company. | Business sign-up with a company name shorter than 2 characters | Type the name |
| You need to accept the terms to continue. | Sign-up without checking the terms box | Check the box |
| Enter the 6-digit code. | A code with fewer than 6 digits | Type the 6 digits |
| Enter your mobile number, with the area code. | The number is too short or too long | Check the number |
| Enter the full number, starting with the country code. | With Other country, the number is out of the format | Type the country code and the number |
When the platform answers
| Message | When it appears | What to do |
|---|---|---|
| Invalid email or password. | The email or the password does not match | Check both, or reset the password |
| This email already has an account. Log in instead. | Sign-up in the Business panel with an email that has an account | Sign in |
| This email already has an account. Sign in instead. | Sign-up in a Personal app with an email that has an account | Sign in |
| That code is not right or has expired. Check it and try again. | A code is wrong, too old or already used | Check it, wait for the next one or ask for a new one |
| That code can no longer be used. Ask for a new one. | The SMS code expired or reached 5 wrong attempts | Ask for another SMS |
| This mobile number already belongs to an account. Use another one. | The number is already in use | Use a different number |
| Wait a minute before asking for another SMS. | Less than 60 seconds since the last SMS | Wait for the countdown |
| No more SMS can be sent for now. Try again later. | An SMS limit was reached | Try again later, or start again from the form |
| This step has expired. Please start again. | The time of the flow ran out, or 5 wrong codes were typed | Start the flow again |
| Your sign-up was not finished and can no longer be continued here. Create the account again. | You signed in with an unfinished sign-up, in another browser | Create the account again |
| Too many attempts. Wait a few minutes and try again. | Too many tries in a short time | Wait a few minutes |
| Check the fields and try again. | The platform refused one of the fields | Check what you typed |
| Could not reach the server. Check your connection and try again. | No connection, or no answer | Check your connection |
Notices that are not errors
| Message | When it appears |
|---|---|
| New code sent. | After Send a new code on the SMS screen |
| If this email is waiting for confirmation, a new code is on its way. | After Send a new code on the screen Confirm your email |
| If there is an account for this email, a new code is on its way. | After Send a new code on the screen Choose a new password |
| Key copied | After the button that copies the authenticator key |
Pages instead of a screen
| Page | When it appears | What to do |
|---|---|---|
| This address is not active | The address of a Personal app is not linked to a company | Check the address with the company that offers the card |
| We could not load the page | The app could not reach the server | Check your connection and select Try again |