Two-step sign-in means a stolen password alone can't get anyone into your account: after your password, you enter a 6-digit code.
Who has it. Every candidate account created since it launched has it from the start — your first code also confirms your e-mail address. Older accounts can turn it on at /applicant/security. If you created your account while buying Priority Review, you're signed in straight away, and your next sign-in asks for a code.
Codes by e-mail. The code goes to your account's address, works once, for 10 minutes. You can ask for a new one every 30 seconds, up to 5 per sign-in. Each code allows 5 tries; 10 wrong codes in a row pause codes for your account for 15 minutes.
Authenticator app. At /applicant/security, choose "Use an authenticator app", enter your password, scan the QR code with an app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy, and enter the first code. Codes then come from the app instead of e-mail. You'll get 10 backup codes; keep them safe — each works once if you lose your phone.
Remember this device. Tick it when you enter a code and that browser skips the code for 30 days (we e-mail you when it happens). Forget devices at /applicant/security. A password reset forgets them all.
Lost your phone and your backup codes? Write to support@sourcehire.app from your account's address. Once we've confirmed it's you, we reset two-step sign-in so codes come by e-mail again. We'll never ask you for a code by phone, e-mail or chat.
Changing any of these settings asks for your password, and every change is e-mailed to you.
Everything we hold about you is one e-mail away, with a download and switches for each consent.