What it is and what it's for#
This page is for whoever has to answer the question "who signed in, from where, and what happened when they couldn't?". Usually, the client's IT or compliance team.
WinChange controls access through four layers that work at the same time:
| Layer | What it prevents |
|---|---|
| Allowed domains | Someone outside the organisation creating an account. |
| Account verification | An account being used when its email address has not been confirmed. |
| Lockout after failed attempts | Trying password after password until one works. |
| Two-factor authentication | A password alone being enough to get in. |
And underneath, every sign-in attempt is logged, whether it succeeded or failed.
This page looks at access from the administrator's side. What the person sees and does when signing in (invitation, password, direct sign-in link) is in Users and access.
How to set it up#
1. Allowed domains#
This is the list of email domains that can be used to create an account through self-registration. Any address outside that list gets "Dominio de email no válido." (invalid email domain) and no account is created.
The list is edited in Company settings, Allowed domains block: one domain per line, without the at sign, saved with Save domains. If you leave it empty, there is no domain restriction.
When the organisation adds a new domain (a subsidiary, a brand, a change of corporate email), add it before anyone tries to register. And do not empty the list by accident: empty means anyone can register.
When registering, the password must meet a minimum: at least 8 characters, with one uppercase letter, one lowercase letter and one number. The account is created unverified and the person receives an email to confirm their address; until they do, they cannot sign in.
2. Account lockout and unlocking#
Each failed password adds one attempt, and the error message tells the person how many they have left ("Credenciales no válidas. Intentos restantes: N", invalid credentials, attempts left). When they run out, the account is locked and the administrators are notified automatically. A successful sign-in resets the counter to zero.
Someone locked out by password attempts can unlock themselves: the lockout message invites them to request a new password with recuperar (recover), and once they change it they have access again.
Two-factor authentication has its own counter: five failed codes also lock the account, with the same notification to administrators. That lock is not lifted by recovering the password: the person sees "Cuenta bloqueada. Contacta con el administrador." (account locked, contact the administrator) and an administrator has to unlock it.
Accounts locked right now are in Blocked Users (Manage › Security, a screen titled Blocked sign-ins). Unblock resets the attempts to zero and gives the person access again; it does not change their password.
Before unblocking, check the reason in Signons & Attempted Signons. Lots of Wrong password usually means a forgotten password. Lots of Wrong code with the password right is something else: there it is worth talking to the person before giving access back.
3. Two-factor authentication#
It is switched on per person, not for the whole company, and not from the panel: it is a request to the team. When it is on, after the password a one-time code is generated and sent through whichever channel the person has switched on under Security alerts in their profile (in-app notification, email, SMS or WhatsApp). The app does not let them switch all of them off while two-step verification is active.
The code has three safeguards and each one has its own message:
- It expires. Once its time is up: "El código de validación ha caducado." (the validation code has expired).
- It cannot be reused. If someone tries one that has already been used: "Ya has intentado acceder utilizando este código de validación. Solicita uno nuevo." (you have already used this code, request a new one).
- It cannot be guessed. A wrong code gives "El código de validación no es correcto." (the validation code is not correct) and adds to the counter that ends in a lockout.
4. The access log#
Signons & Attempted Signons (Manage › Security) is the log of sign-in attempts: when, who, what happened (signed in, was waiting for the code, or why they could not get in) and from what kind of device. It can be filtered by result, reason, device and period; when you open it, it shows the last week. It is read-only and only administrators see it.
5. Change traceability#
Apart from sign-ins, the system keeps an audit log of changes to the data. Each entry records the action (create, edit), what it was done to, what it looked like before and after, which system operation did it, and which person triggered it.
It is written, among other things, when a user is created, an account is unlocked, actions are assigned, a submission is approved or rejected, a comment is moderated and points are moved. Whatever is created or sent from an AI assistant connected through Connect your AI is logged too, under the administrator who authorised the connection.
This log is consulted through the WinChange team: ask them for the period or the export you need. If your compliance team needs regular exports, raise it before launch.
What employees see#
- None of this. Neither the access log nor the change log.
- When the password fails, they see how many attempts they have left before the account locks.
- If they are locked out by password attempts, the message invites them to recover the password; if they are locked out by codes, they see the message telling them to contact the administrator.
- If they have not confirmed their address yet, they see "Verifica tu cuenta para continuar" (verify your account to continue).
- In Your profile they choose which channels their Security alerts use, and they have the Delete my account option.
- During a maintenance stop, nobody gets in and everyone sees the same message.
Frequently asked questions#
Can I turn on two-factor authentication for the whole workforce at once?
Not from the panel: it is a per-person setting. If you want to require it for a whole group, it is a request to the team.
Someone says they can't sign in but they don't appear in Blocked Users. What should I check?
Look them up in Signons & Attempted Signons and check the What happened column. The usual reasons that are not a lockout: Account not verified, Email not on file (they are typing an email other than the one on their profile) or that they have been deactivated in Users.
I see failed attempts from an email I don't recognise. Is it an attack?
An email that does not match any account appears as Email not on file, with only the typed email and no name. It is usually someone mistyping their address. What is worth checking is the pattern: many attempts in a row on several different accounts. In that case, give the team the specific period.
If I unblock someone, do I change their password?
No. Unblocking only lifts the lock and resets the attempts to zero; the password is still theirs. If it needs changing, you can replace it from their profile, in the Password field in Users, or ask them to recover it.
How long are these logs kept?
That is a question for the team: the retention policy is not visible or configurable from the panel.
Can I export the access log?
Narrow the dates in Period to review it on screen. For a formal delivery to an audit, ask the team.
Limits and caveats#
- Unblocking someone does not fix why they were locked out. If they get locked out again a few minutes later, stop unblocking and check What happened in Signons & Attempted Signons.
- An administrator can only unblock people from their own company and their own project. If the person belongs to another one, the operation is rejected.
- The access log only covers signing in. It does not say what the person did once inside; that is in the audit log, which you request from the team.
- The allowed domains list only affects self-registration. An individual sign-up or an import can add an address from any domain: the barrier is whoever adds people, not the system.
- Lockout notifications go to administrators. If nobody watches that mailbox, an account locked by codes stays locked indefinitely.
- Encryption, data location, log retention and personal data processing are not visible or configurable in the panel. They are contractual questions: ask the team for them in writing before the security review, do not infer them from these screens.