Account security and recovery

GraphJSON account security protects the dashboard. Workspace API keys protect programmatic access. They are separate credentials and require separate response plans.

Security controls at a glance#

Changing a password does not rotate an API key. Removing a teammate does not remove a key copied into an external service.

Change your password#

While signed in:

1. open Dashboard → Security
2. enter the current password
3. enter and confirm a new password
4. select Update Password

Use a long, unique password stored in a password manager. Do not reuse the production database, cloud provider, or billing password.

Changing the password can require recent authentication. If the current password is unavailable, use the reset flow instead.

Reset a forgotten password#

1. Open Reset Password.
2. Enter the exact email used by the GraphJSON account.
3. Submit the form.
4. Open the reset email and follow its link.
5. Return to the GraphJSON login page.

If the message is absent:

• check spam and corporate email filtering
• confirm the account email
• wait for the latest message rather than using several old links
• request one new reset after correcting the address

Do not forward a password-reset link. Treat it as a temporary credential.

Enroll SMS two-factor authentication#

GraphJSON currently supports phone-based SMS as the dashboard’s second factor.

1. Sign in and open Dashboard → Security.
2. Enter the phone number with country code, such as +12223334444.
3. Select Update Two Factor Authentication.
4. Re-enter the password when requested.
5. Enter the verification code received by SMS.
6. Confirm that enrollment succeeds.
7. Sign out and test one complete sign-in before depending on the factor.

SMS delivery depends on the phone number, carrier, signal, and provider availability. Do not enroll a shared phone number or a number the organization cannot recover.

Sign in with two-factor authentication#

After the password succeeds, GraphJSON sends an SMS code to an enrolled factor.

Enter only the newest code. If a code is delayed:

1. confirm the displayed phone hint
2. confirm the device can receive SMS
3. avoid requesting many codes rapidly
4. retry in a fresh sign-in session

GraphJSON support should never ask for the one-time code.

Replace or lose the enrolled phone#

The current dashboard does not document a self-service recovery-code or factor-removal workflow.

Before replacing a working phone, enroll and test the intended number from the Security page when the product permits the update.

If access to the enrolled phone is already lost:

1. keep access to the account email
2. gather the workspace name and account email
3. email hi@graphjson.com from that address
4. do not send a password, SMS code, API key, or identity document unless a secure process is explicitly arranged

Do not create a replacement workspace merely to bypass account recovery if production data and billing remain attached to the original one.

Manage browser sessions#

Use Dashboard → Settings → Log Out when leaving a shared or untrusted device.

The current dashboard documents sign-out for the active device. It does not publish a self-service list of every active session or a “sign out everywhere” control.

If a session may be compromised:

1. change the password
2. sign out of the available session
3. review workspace members
4. inspect recent dashboards, queries, alerts, and integrations
5. contact support with the approximate exposure window
6. treat API-key exposure separately

Secure a team workspace#

• give every person an individual login
• enroll two-factor authentication
• avoid shared inbox credentials
• keep the billing owner current
• review membership after role changes
• inventory services that hold the workspace API key
• separate production and non-production workspaces when strict isolation matters

An individual login provides accountability that a shared account cannot.

Use Manage workspaces and teams for invitation and offboarding guidance.

Offboard a teammate#

1. identify the workspace and person
2. remove their workspace access
3. transfer ownership of dashboards, queries, alerts, and billing knowledge
4. remove their email or phone from alert recipients
5. revoke access to internal secret managers and deployment systems
6. replace any API key copied to a personal system
7. review customer-facing links they distributed

Removing GraphJSON access does not revoke an embed URL already shared with another person.

Respond to a suspected compromise#

Account password or session#

1. change or reset the password
2. complete two-factor authentication
3. sign out
4. review membership and recent workspace changes
5. contact support with a narrow incident window

Workspace API key#

1. remove the key from the exposed source
2. restrict the affected repository, log, or artifact
3. identify every legitimate sender
4. contact support for replacement
5. update senders and integrations
6. inspect unexpected ingestion and data access

Removing a secret from the latest commit does not remove it from repository history.

Current limitations#

GraphJSON does not currently document:

• authenticator-app or hardware-key MFA
• downloadable recovery codes
• a self-service factor-removal flow for a lost phone
• an active-session inventory
• a self-service “sign out everywhere” action
• self-service creation of multiple scoped API keys

Do not write an internal security policy that assumes these controls exist. Use the available controls and contact GraphJSON before a regulated or high-assurance deployment depends on an undocumented capability.

Account security checklist#

• Password is unique and stored in a password manager.
• SMS two-factor authentication is enrolled and tested.
• Recovery email and phone ownership are current.
• Every teammate uses an individual login.
• Former members and alert recipients are removed.
• API keys exist only in server-side secret stores.
• Production and test access boundaries are documented.
• Billing ownership survives personnel changes.

Continue with API keys and security and Security review and shared responsibility.