Signing in and keeping your account secure¶

How to manage your account and set up multi-factor authentication.

Managing your account¶

Signing in¶

You sign in with your work email and password at your workspace's sign-in page. Sessions use OpenID Connect with PKCE; the dashboard and your AI client each hold their own short-lived tokens, and nothing shares your password.

Resetting a forgotten password¶

Use Forgot password? on the sign-in screen. We email you a single-use reset link that expires after a short window. If the email does not arrive within a few minutes, check spam, then confirm you entered the address your account was created with.

Changing your password¶

While signed out, the reset flow above is also the supported way to rotate your password. Email and display-name changes are handled by support at [email protected], with verification from the account's email address.

Inviting teammates¶

A Tenant Admin invites teammates from Settings in the dashboard; your AI cannot add or remove people. Roles and inviting your team covers each role and the invite steps. Every workspace member gets their own identity; approval decisions are attributed to the signed-in account, so each person needs their own. Users are unlimited and carry no per-user fee, so give everyone who approves or authors their own account rather than sharing one.

Cancelling your subscription¶

Cancel from your workspace settings. Your subscription: upgrading and cancelling walks through each step. If you cancel during the 14-day trial, before day 15, your card is never charged.

Cancellation always takes effect at the end of your trial or of the billing period you have already paid for, never immediately. Until that date nothing changes: your workspace stays fully active, your AI keeps working, and your record stays where it is. If you change your mind, you can undo the cancellation in Settings until that date.

Export your record any time before your subscription ends. When it ends, nothing is deleted, and the workspace stops accepting changes.

Leaving or deleting a workspace¶

To close your workspace, email us. Export your record first; we will confirm in writing what we did.

Multi-factor authentication¶

What we support¶

Kanonik uses time-based one-time passwords (TOTP) with any standard authenticator app: 1Password, Google Authenticator, Microsoft Authenticator, Authy, and similar. We do not use SMS codes; SMS is vulnerable to SIM-swap attacks and does not meet the bar for a compliance product.

Who is required to use it¶

Accounts holding privileged operator access (staff-level access that spans workspaces) are required to use TOTP. If a required account has no authenticator enrolled, enrolment is forced at the next sign-in: you scan a QR code with your app and confirm one code, and from then on sign-in asks for your current code.

Turning it on for your own account¶

Email [email protected] from your account address and we enable TOTP enrolment for you; your next sign-in walks you through the QR-code setup.

If you lose your authenticator¶

Contact support from your account's email address. We verify you, reset the enrolment, and your next sign-in sets up a new authenticator. Note that the approval links at the heart of Kanonik are separately protected: each is single-use, signed, and expires within the hour, whether or not MFA is involved.

Every workspace authenticates through Kanonik's identity service (OpenID Connect with PKCE). Your AI client connects over MCP using OAuth and registers itself automatically the first time it connects; it never sees or stores your password, and its tokens are short-lived and scoped to your workspace.

Getting more help¶

Support is async by design and answered by people who work on the product: [email protected]. Security questions and our posture live on the security page; the binding terms are in the Terms, Privacy Policy, and DPA.

More help¶

Browse every article in the Help center. For anything else, email [email protected] and a person who works on the product answers.