Account security

The security of your Schoolysoft account is essential to protect your school’s data and pupils’ records.

Password

Your Schoolysoft password must meet the rules shown on screen when you create or reset it, in particular:

• 12 characters minimum recommended.
• A mix of uppercase letters, lowercase letters, numbers, and special characters.
• Not be reused from another service.

There is no “Change password” option under My account. To set a new password, use the Forgot password link on the sign-in page: you will receive a reset e-mail.

Two-factor authentication (MFA)

MFA is mandatory for all Schoolysoft accounts without exception. Two methods are available, and they are mutually exclusive:

• TOTP application (Google Authenticator, Authy, etc.): 6-digit code renewed every 30 seconds.
• FIDO2 security key / passkey: physical USB key or biometrics (fingerprint, Face ID) — the most secure method.

See the guides Set up TOTP MFA and Set up FIDO2 for detailed instructions.

Recovery codes

When setting up MFA, you receive 8 single-use recovery codes. Store them in a safe place (offline). If you lose access to your TOTP application, use a recovery code to sign in, then reconfigure MFA.

Account lockout

After 5 failed sign-in attempts, your account is temporarily locked for 15 minutes before you can try again.