Skip to content
TornalyDocs
On this pageHow sign-in works

Security & privacy

Sign-in & sessions

Tornaly has no passwords. You sign in with a one-time code sent to your email.

How sign-in works

  • Enter your email and choose Email me a code.
  • The email has a 6-digit code and a sign-in link. Use either one.
  • The code works for 15 minutes, once, with up to 5 tries.
  • The link opens a page with a Sign in button, so email security scanners that open links can’t use up your code.
  • Signing in with a new email creates your account.

Limits that stop guessing

WhatLimit
Codes requested5 per email per hour, 20 per network per hour
Sign-in attempts10 per email per hour, 30 per network per hour

Past a limit, you’re asked to try again in an hour.

The sign-in page and the start of a new web chat can also ask for a quick, usually invisible check that you’re a person, not a script (Cloudflare Turnstile), where it’s switched on.

Sessions

  • You stay signed in for 30 days on each device, then sign in again.
  • Sign out ends the session on that device only.
  • Sign out on all devices, in your account menu, ends every session you have — use it if you lost a phone or signed in on a shared computer.
  • When someone is removed from your team, they lose access immediately — on every device.
  • If you belong to more than one business, switch between them from the sidebar.

Behind the scenes

  • Codes and session keys are stored only in scrambled (hashed) form, so a copy of our database can’t be used to sign in.
  • Session cookies can’t be read by scripts on the page, and are only sent over secure connections.
  • Access is checked by role on every request, not just in the menus.
  • Tornaly staff who can open the platform admin area must also use two-step verification with an authenticator app.
  • Old sign-in codes and sessions are deleted automatically. See Your data.

New businesses

A new business may be reviewed by our team before it goes public: until it’s approved (usually within a day), its public links and the AI front desk’s replies stay off, and a banner says so. Each person can run one business.