User Profile

Your user account is personal. One account can be a member of any number of projects and agencies; what you may do in them is decided there — see Identity & Access. Everything that belongs to you as a person is in the account menu at the top right of the dashboard:

1. Enter your work email address on the sign-up page.
2. Open the confirmation link we email you. It is valid for 24 hours.
3. Complete your profile — your name or company name, a password, and how you plan to use TrustComponent: for your own or your company’s websites, or for client projects as an agency, software company or consultancy. Accept the terms and the privacy policy.
4. You are signed in. If you chose for client projects, the dashboard continues with creating your agency; otherwise with creating your first project.

• If your email domain uses single sign-on, you are sent to your company’s identity provider instead, and no password is needed.
• If you were invited to a project or agency before you had an account, sign up with exactly the invited address — the invitation then waits on your Home page.
• If an account already exists for the address, we send a note to that address instead of a new confirmation link.

The sign-in page asks for your email address first and then continues the right way:

• Password — the usual way. Stay logged in keeps you signed in on this device for 30 days, renewed whenever you use it.
• Sign-in link — choose Email me a sign-in link and use the link or the 6-digit code from the email. It is valid for 15 minutes and works once; requesting a new one cancels the previous one.
• Single sign-on — if your email domain belongs to a single sign-on configuration, you are sent to your identity provider.

You can sign in with any of your verified email addresses.

After several failed attempts, the sign-in page first asks you to confirm that you are human and then blocks further attempts for a while. This protects your account; just wait until the timer has run out.

We send you an email when someone signs in to your account from a new device or a new location, with the device, browser, IP address and approximate location. If that wasn’t you, change your password right away.

Signing out ends the session and removes Stay logged in on all your devices. Changing your password ends every session and every Stay logged in as well.

With a second factor, a stolen password is not enough to get into your account. Set it up under Sign-in & Security. Once active, every sign-in asks for it — after a password, a sign-in link, single sign-on or Stay logged in.

1. Choose Enable and scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy …), or type the key manually.
2. Confirm with a 6-digit code from the app.
3. Save your 8 recovery codes. They are shown only once. Each code works once instead of the app, if you lose your phone.

You can regenerate recovery codes at any time — all previous codes become invalid. The page warns you when only a few codes are left.

Add a passkey or a security key — YubiKey, Touch ID, Windows Hello or a passkey synced by your device. Give each one a name; you can register as many as you like. Passkeys are used as second factor after your sign-in, not as a replacement for it.

If you have lost every second factor and every recovery code, you cannot sign in yourself. You can contact our support — we can try to verify your identity, but we cannot guarantee that we can restore access to your account.

Projects and agencies can require a second factor from all members. If one of them does, you are asked to set one up before you can open it.

Forgot your password? on the sign-in page emails you a link that is valid for 15 minutes. If two-factor authentication is active, you confirm the second factor before you choose the new password.

Your account can hold several email addresses — for example your work address and a shared team mailbox.

• Add an address and confirm it with the link we send; the link is valid for 1 hour. An address can belong to one account only.
• For every address, choose its usage: Send notifications or No notifications. Notifications go to every address set to Send notifications.
• Your preferred address is the one shown in your profile and in emails to others. To remove it or stop its notifications, choose another preferred address first. The last address cannot be removed.
• Invitations to projects and agencies reach you through any of your addresses.

• A password needs at least 12 characters — length is the only rule, so a passphrase works well.
• Change password asks for your current password and signs you out everywhere.
• If you signed up through single sign-on, your account has no password. Set password adds one as a fallback, for example if the single sign-on configuration is removed later.

Notifications › Changes and projects subscribes you to news about important changes, new features and offers. Emails about your projects, invoices and security are sent regardless.

If you sign in through a company identity provider, the linked identities appear under Sign-in & Security with their provider and email address. You can unlink an identity unless it is your only way to sign in — set a password first. Signing in through the identity provider again links it again. Details: Single Sign-On.

Your payment methods belong to your personal account, because the bill recipient of a project or agency pays with their own methods. Payment & Invoices lists your cards and SEPA mandates, the charges that will appear on your next invoice (Outstanding line items) and every invoice addressed to you. How payment methods work is described in Billing.

Sign-in & Security › Latest logins lists the browsers and devices that signed in to your account, with browser, operating system, IP address, approximate location and time. Open an entry for its full sign-in history. If you see a sign-in that wasn’t you, change your password.

Contracts & consents lists agreements we concluded with you as a person — set up by our team — and the consents you gave, such as the terms and the privacy policy. Contracts of a project, such as the DPA, are in the project under Governance › Contracts.

Profile › Export personal data downloads everything we store about you as a ZIP file: your account, your activities, your tickets, your invoices and contracts.

You can delete your account yourself under Profile › Delete account.

The page first lists everything that is still attached to your account and tells you what happens to it:

Then pick a reason and confirm. Your account is deleted automatically as soon as nothing blocks it any more — right away if nothing is attached. Until then you can choose Keep my account to cancel. While the deletion is pending, you cannot create projects or agencies or accept invitations.

Deleting removes your account, your sign-ins and sessions, your single sign-on links and your personal tickets. Invoices and billing records are kept as long as the law requires.

I don’t receive the confirmation or sign-in email. Check the spam folder. Confirmation links are valid for 24 hours, sign-in links for 15 minutes; request a new one if it has expired.

The sign-in page says I have to wait. Too many attempts were made for your address or your network. Wait until the timer runs out, or use a sign-in link.

I am sent to my company’s identity provider, but I want to use my password. Your email domain uses single sign-on. If your account also has a password, the redirect page offers a fallback link. Otherwise, sign in through your identity provider.

I lost my phone with the authenticator app. Sign in with one of your recovery codes or a passkey, then set up the app again. See Lost second factor.

I don’t see an invitation. The invitation was sent to an address that is not in your account. Add that address under Email addresses, or ask for an invitation to one of yours.