What happens when you sign in
Enter your email and password as usual. Orphex then emails a verification code to that same address. Enter the code and you're in.
The code is valid for 10 minutes. If it expires, request a new one from the same screen.
That's the whole change. Your password, your workspace, your integrations, and your data stay exactly as they are.
Why it's required
Two reasons: what Orphex is becoming, and what our customers now ask of us.
Orphex is moving from a platform that tells you what to do to one that can do it for you. AI Workflows, Orpheus, and MCP connections let Orphex act on your ad accounts — pausing campaigns, adjusting budgets, changing targeting — within the permissions each member holds.
That raises the cost of a forgotten account. When someone leaves a company, their Orphex access often outlives their last day, because removing them is a manual step that's easy to miss. A forgotten account used to mean someone could still read your reports. Now it can mean someone can still spend your budget.
A password on its own doesn't close that gap. A code sent to a work email does: once IT disables the mailbox, the Orphex account stops working the same day, whether or not anyone remembered to remove the member.
The second reason is simpler. Security expectations have moved, and so have the questions in the vendor reviews you send us. Mandatory 2FA is one of the access-control requirements in our [ISO 27001 / information security] programme.
What we still need from you
2FA is a safety net, not a replacement for offboarding. It narrows the window between someone leaving and someone being removed. It doesn't remove them.
When a colleague leaves, go to Settings → Permissions and remove their access. Two reasons this matters:
If they still reach the mailbox — a personal address, or a forwarding rule left behind — 2FA won't stop them.
Removing the member is what actually revokes their permissions, their scheduled reports, and their API and MCP connections.
A quarterly look through your member list is usually enough to keep this clean.
Frequently asked questions
Can we turn 2FA off for our organization?
No. It applies to every Orphex account, admins included. It's a platform policy rather than an organization setting, which is why you won't find a toggle in Settings.
Can we use an authenticator app or SSO instead?
Not yet — email is the only method today. If either one matters for your team, tell your customer success contact. It helps us prioritize.
The code didn't arrive.
Check your spam folder first. The sender is noreply@orphex.co — ask your IT team to allow that address if it's being filtered. You can request a new code from the sign-in screen as often as you need.
Do I need a code every time?
Yes, on every sign-in. Staying signed in doesn't trigger a new code, so in day-to-day use you'll see it far less often than you'd expect.
Does this affect our API keys, scheduled reports, or MCP connection?
No. 2FA applies to interactive sign-ins only. Anything running on a token or a schedule keeps working without interruption.
Where do I see this in the product?
Settings → Account → Security. The row confirms 2FA is active on your organization. There's nothing to configure there.
Still have questions? Reply to this article or write to support@orphex.co.