Account and security

Signing in

The sign-in screen has two parts: on the left, the ChatISP presentation, and on the right, the Welcome back card with the form. Each installation (and each ChatISP Cloud service center) has its own user base, registered by the internet service provider (ISP) administrator in Agents.

Screen elements

What happens after signing in

• If the account has two-step verification, the Verify your identity step appears, asking for the code from the authenticator app.
• Users with the Supervise all conversations permission land on the Conversations screen; everyone else goes straight to Service mode.
• If you opened a system link without being signed in (for example, the link to a conversation or a service order received from a colleague), the link is kept during sign-in, including the verification step and password recovery, and you land exactly on it when you get in.

Common messages

Strong password

Every password set in ChatISP must be Strong: when registering an agent, accepting an invitation, changing the password in My account, recovering the password and creating the first administrator. The screens show a live meter with five levels (Too short, Weak, Fair, Strong, Excellent) and tips on what to improve. The meter and the server use exactly the same rule: if the meter showed Strong, the system accepts it.

How strength is calculated

Below 8 characters the password is always Too short and is rejected with The password must have at least 8 characters. From 8 characters on, it adds up points:

Result: up to 2 points is Weak, 3 points is Fair, 4 or 5 points is Strong and 6 or more is Excellent. The minimum required is Strong (4 points). Passwords that fall short are rejected with The password must be strong: use at least 8 characters mixing upper and lower case letters, numbers and symbols.

Examples of combinations that reach Strong

Recovering your password

Recovery is done on the sign-in screen itself, with a 6-digit code sent to the channels registered on your account.

1. On the sign-in screen, click Forgot my password.
2. Enter your sign-in email and click Send code.
3. The code arrives on your account's verified WhatsApp (through the system's connected WhatsApp) and at the registered email. The screen tells you where it went, for example "the WhatsApp ending in 8888 and the email m***@provider.com".
4. Type the code in Verification code and click Verify.
5. On the Create a new password screen, fill in New password and Confirm password (with the same strength meter) and click Save new password.
6. The screen returns to sign-in with Password changed. Sign in with the new password.

Code rules

What the reset does

• All other sessions of the account are ended: anyone using the old password on another device is signed out immediately.
• If there was a pending invitation for the account, it is canceled (the account now has its own password).

When the code does not arrive

Two-step verification

Two-step verification (2FA) adds a second factor to sign-in: besides the password, the system asks for a 6-digit code generated by an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Authy and similar). It is optional and each person enables it on their own account.

Enabling

1. Open My account (click your name in the side menu footer).
2. On the Two-step verification card, click Enable.
3. Follow the steps: 1. Scan the QR code in your authenticator app; 2. Or enter this key manually; 3. Type the 6-digit code to confirm.
4. Click Confirm and enable. Two-step verification enabled. appears and the card now shows 2FA enabled on your account.

Enabling only completes when a correct code confirms the pairing. If you abandon it halfway, nothing changes on the account.

Signing in with 2FA

After the correct password, the Verify your identity screen asks for the Verification code. The code tolerates a small clock difference between the phone and the server (about 30 seconds either way). This step:

• must be completed within 5 minutes after the password;
• accepts at most 5 wrong codes; after that, you must type the password again.

If you checked Keep me signed in on this browser, the code is only requested at sign-in; it is not requested again when that browser resumes the session automatically.

Disabling

On the same card, click Disable and confirm with your Current password. Without the password nothing is disabled, which protects the account in case someone finds one of your sessions open.

Keep me signed in (trusted browser)

Without the option checked, the session lasts while the browser is open and in use: closing the browser or leaving the system idle for a long time takes you back to the sign-in screen.

With Keep me signed in on this browser checked at sign-in, that browser becomes a Trusted browser:

• You stay signed in for 30 days without entering email and password again, even if you close the browser or leave the computer idle.
• The period is sliding: each use renews the 30 days. It only expires if the browser goes 30 days without opening the system.
• Two-step verification is not requested when the session resumes: that is exactly what trusting the browser means.
• Each browser has its own trust. Checking it on your work computer does not affect your phone.
• Clicking Sign out in that browser, or ending its session in My account, removes the trust immediately.
• If the account is deactivated or deleted, the trust is no longer valid.

In Secure sessions, the trusted browser appears with the Trusted browser tag and the date until which it stays signed in.

Protection against repeated attempts

ChatISP makes it hard to guess passwords and codes at every access step:

In addition, session cookies only travel over a secure connection (HTTPS) and are not accessible to page scripts, and every form carries its own token that prevents another site from submitting actions on your behalf.

Sessions and Secure sessions

Each browser or device you signed in from is an independent session: signing in on your phone does not sign out your computer, and there is no limit on simultaneous sessions. They all appear on the Secure sessions card of My account: "Browsers and devices connected to your account, one per device. End the ones you do not recognize."

What each row shows

• A phone or computer icon and a summary of the browser and operating system (for example, "Chrome - Windows" or "Safari - iOS").
• This session, on the session you are using right now.
• Trusted browser, when the session was started with "keep me signed in", with Signed in until the expiration date.
• The IP address, when the session started and when it was last used.

Ending sessions

• End, on a session's row: signs out that session. On the next click, the device returns to the sign-in screen.
• End other sessions: signs out every session of your account except the current one.

Each person can only end their own sessions. To remove someone from the system immediately, the administrator uses agent deletion (see Delete), which signs out every session of the account.

My account

Open it by clicking your name (with your initial highlighted) in the side menu footer. The page gathers, in cards, everything that is yours: details, alert WhatsApp, Google Calendar, sound alerts, password, two-step verification and sessions. Any signed-in user can access their own account, without needing a permission.

My details

Change Name and Email and click Save. The name is how you appear to the team and in reports. The email is your sign-in and the password recovery channel: if you change it, sign in with the new one from then on.

Agent's WhatsApp

"Number that receives support alerts, such as conversations transferred to you." The card shows the current number with the Verified or Not verified tag.

1. Click Change number, type the number (with area code; +55 is added automatically) and confirm with your Current password ("For security, confirm your password."). Saving a new number leaves it as not verified.
2. Click Verify: a 6-digit code reaches the number through the system's connected WhatsApp.
3. Type the code and click Confirm. WhatsApp verified. appears.

Once the number is verified, the Receive support alerts switch turns the alerts on or off. The verified number also starts receiving the password recovery code. With no WhatsApp connected to the system, the card warns: Connect a system WhatsApp to be able to send the verification code.

Google Calendar

Appears when the Google Calendar integration is available on the installation. With Connect my Google account, the appointments you own also appear in your Google calendar (not the other way around: ChatISP is the source). The Reconnect and Disconnect buttons appear once connected. Details in Calendar.

Sound alerts

By default, the sounds defined by the administrator for the whole system apply. Turn off Use the system default sounds to choose your own. For each alert type you choose the sound (Soft, Drop, Bell, Chime, Crystal, Alert, Phone ring or No sound), listen to it with the Listen button and set the Volume from 0 to 100%:

Click Save to store your choices. Turning Use the system default sounds back on discards your choices and follows the default again.

Change password

Fill in Current password, New password (with the strength meter) and Confirm password and click Change password. The new password must be Strong. If the current password is wrong, The current password does not match. appears.

Two-step verification and Secure sessions

Described in Two-step verification and Sessions and Secure sessions.

Personal preferences

Some choices are stored in your account and follow you on any device:

What is not a personal preference

• Language: the interface language (Portuguese, English or Spanish) belongs to the whole system and is set by the administrator in Settings (System language). See Interface.
• Message signature: the Sign messages with the agent name option is turned on for everyone in Settings. With it on, each agent can turn off the signature in a specific conversation with the signature button in the message field.
• Photo: agents appear with the initial of their name highlighted; there is no profile photo upload.

Audit log

The Audit log screen is the record of who did what in the administrative areas of the panel. It requires the Audit log permission (see permissions).

What is recorded

Every action that changes something in the areas below and completes successfully. Rejected attempts (due to missing permission, an invalid field or an error) are not recorded.

Queries, listings and automatic screen refreshes (such as the QR code or the status of a connection) are not recorded, so the history only shows what matters.

Columns and details

Click a row to open the full Audit record, with each field sent in the action. Sensitive fields (passwords, keys, tokens, secrets and codes) are never stored: they appear as ***. Very long values are truncated.

Filters

• Period, at the top: Last 7 days, Last 30 days (default) or Last 90 days.
• Username: everyone or one person.
• Area: all or one area.

The table loads the most recent records first and fetches older ones on its own as you scroll the page.

AI consumption

The AI consumption button, at the top of the Audit log, opens the artificial intelligence cost audit: what the AI consumed in each conversation and how much it cost, with the same permission. It is described in Reports and management and in Artificial intelligence.