Securing Your Vacua Account

Your account security is important. This guide explains how to enable two-factor authentication, change your password, and protect your account against unauthorized access.

FLUXER_HORIZONTAL_RULE_PLACEHOLDER

Enabling two-factor authentication (2FA)

Two-factor authentication adds a second layer of protection beyond your password. We strongly recommend enabling it.

What you'll need

A TOTP authenticator app such as:

• Google Authenticator (iOS / Android)
• Authy (iOS / Android / Desktop)
• 1Password or Bitwarden (if you use a password manager with built-in TOTP)

Steps to enable 2FA

1. Go to User Settings → Account → Security.
2. Click Enable Two-Factor Authentication.
3. Open your authenticator app and scan the QR code shown on screen.
4. Enter the 6-digit code generated by your app to confirm.
5. Save your backup codes — store them somewhere safe (password manager, printed copy). These let you recover access if you lose your phone.

Warning: If you lose access to your authenticator app and don't have backup codes, account recovery may not be possible.

---

Changing your password

1. Go to User Settings → Account.
2. Click Change Password.
3. Enter your current password, then your new password twice.
4. Click Save. You'll be logged out of other sessions automatically.

Strong password tips

• Use at least 12 characters
• Mix uppercase, lowercase, numbers, and symbols
• Never reuse passwords across sites
• Consider a password manager (Bitwarden, 1Password, etc.)

---

What to do if your account is compromised

If you believe someone else has access to your account, act quickly:

1. Change your password immediately

Follow the steps above. This will invalidate all existing sessions.

2. Revoke active sessions

Go to User Settings → Account → Active Sessions and click Log Out All Other Devices.

3. Check your connected email

Make sure your recovery email hasn't been changed. If it has, contact Vacua Support immediately via the Help Center.

4. Review authorized applications

Go to User Settings → Authorized Apps and revoke any apps you don't recognize.

5. Enable 2FA if you haven't already

This prevents future unauthorized logins even if your password is stolen.

FLUXER_HORIZONTAL_RULE_PLACEHOLDER

Managing active sessions

Vacua keeps a log of all devices currently logged into your account.

1. Go to User Settings → Account → Active Sessions.
2. You'll see each session with a device type, location estimate, and last active time.
3. Click the X next to any session to remotely log it out.
4. Use Log Out All Other Devices to bulk-revoke everything except your current session.

---

Trusted devices

When logging in from a new device, Vacua may ask you to verify your identity via email or 2FA. Once verified, you can mark a device as trusted to skip this step in the future.

To remove a trusted device:

1. Go to User Settings → Account → Trusted Devices.
2. Click Remove next to the device you want to untrust.

---

Phishing and account safety tips

• Vacua will never ask for your password in a DM or email.
• Be wary of links sent by strangers — hover before clicking.
• If an "admin" DMs you claiming your account is at risk, it's almost certainly a scam. Report it instead.
• Use a unique email address for your Vacua account.