Account security
The ways you can sign in to SIMCOAI, and which to choose for an account that can spend money and read customer conversations.
Where signing in happens
Choosing to sign in takes you to a SIMCOAI-run sign-in address — id.simcoai.co.uk. It is SIMCOAI’s own, not a third-party page you have been handed off to, and it is the same account throughout — there is nothing separate to register.
It is a separate address on purpose. Passwords, one-time codes and sign-in links are handled entirely by that service, so they never pass through the dashboard or through your workspace. When you reset or change a password, you set the new one there and it is never sent to, or stored by, the rest of SIMCOAI.
Your business data — your profile, customers, bookings, calls and conversation history — stays in SIMCOAI’s own database and is linked to your account by an identifier, not by your password.
- Signing in: you are taken to your account’s sign-in address and returned to your dashboard once you are in.
- Changing your password: Security in the dashboard emails you a secure link. The form does not ask for the new password, because your workspace is not where it is set.
- Signing in with Google or GitHub: there is no separate SIMCOAI password on your account at all, and the dashboard tells you so rather than offering to change one.
- Where your password lives: only on the sign-in service. SIMCOAI holds no password record for your account, in any form.
- Where you change things: two-step verification methods are added and removed on the sign-in page itself, so a change applies everywhere rather than to one browser. Connecting or disconnecting Google or GitHub is done from Security › Connected accounts in the dashboard, and only while you are already signed in — a matching email address is never enough on its own to link a new sign-in method to your account.
If you ring our support line about your account
The line can send you a password reset link, and that is the only thing it does to an account. The link is delivered to the mailbox you name and is useless to anyone who does not already control it, so it needs no further check — it grants nothing that the reset link on the sign-in page does not already grant any visitor. It answers the same way whether or not that address has an account, so nobody can use it to work out who banks with SIMCOAI.
- We cannot read your password, and neither can anyone else. It is held as a one-way scramble. There is no screen, export or support tool anywhere that returns it — this is not a permissions limit we could lift.
- We will not set a new one for you. Not on the phone, not by email. You set it yourself through the reset link.
- Two-step verification, passkeys and security keys are never removed by phone, nor is the email address on an account changed or an account unlocked. Those are precisely what somebody impersonating you would ask for, so they go to a person who verifies you first.
- We will never ring you and ask for a password, a one-time code, or to approve a prompt you did not start. If somebody does, it is not us. End the call and ring the published number.
Sign-in options
| Method | Strength | Notes |
|---|---|---|
| Passkey | Strongest | A fingerprint, face or device PIN prompt. Phishing-resistant, nothing to type. Enrol it as “This device” from Security › Two-step verification, then choose Continue with a passkey when you sign in. Bound to your device unless your platform syncs them. |
| Authenticator app | Strong | Time-based codes from an app on your phone. Enrol it yourself from Security › Two-step verification — no need to contact support. |
| Security key | Strong | A physical key such as a YubiKey. Enrol it yourself from Security › Two-step verification, the same way as an authenticator app. |
| Text message code | Backup only | A one-time code by text. Available as a second factor alongside another method, not as your only way in — a phone number alone is not accepted as a primary sign-in method. |
| Google sign-in | Good | Security follows your Google account, including its own MFA. |
| GitHub sign-in | Good | Security follows your GitHub account, including its own MFA. |
| Email and password | Standard | Set during sign-up or added later. A short human-verification check may appear on the sign-in page — this is normal and protects the form from automated abuse. |
Turning it on
Two-step verification is opt-in and lives on its own page: Security › Two-step verification. It cannot be switched on with nothing enrolled — enrol a method first, then turn the setting on. This order exists so that someone who only has your password cannot enrol their own second factor and lock you out.
Removing your last enrolled method automatically switches two-step verification back off, rather than leaving it on with nothing able to answer a challenge. You can enrol more than one method and choose which one you are offered first; every other enrolled method still works as a fallback even after you reorder them.
Linking Google or GitHub to an existing account
If you already have a SIMCOAI account and want to add Google or GitHub as another way in, use Security › Connected accounts while already signed in. A matching email address alone is never enough to attach a new sign-in method to your account — you must start the link from inside your own signed-in session. The one exception is your very first sign-in: if you have never signed in with Google or GitHub before and no other identity is on file, that first sign-in succeeds without an extra step, so migrated and existing customers are not locked out.
You cannot disconnect your only remaining sign-in method — the option is refused rather than allowing you to lock yourself out. Connecting or disconnecting a method emails the account owner.
Re-confirming for sensitive changes
Changing two-step verification settings, removing an enrolled method, or connecting/disconnecting a sign-in source all ask you to confirm your sign-in again first, even within an active session. This re-confirmation expires after a short time separate from your normal session length, so it needs repeating if you come back to it later. Merely viewing your security settings does not require it — only making a change does.
What we suggest
- Add a passkey on the device you use most, and keep a second method as backup. This is the strongest option available today and takes one tap at sign-in.
- Keep your password as the backup if you add a passkey, so losing the device does not lock you out.
- Do not share one login across a team - individual accounts mean the audit trail is meaningful.
- Remove access when someone leaves. This is the most commonly skipped step.
Things SIMCOAI will never do
If you cannot get in
See login problems. Support cannot bypass MFA for you - that is the point of it.