Your account and signing in

Your account holds your name, the email address you sign in with, your password and your sign-in security.

To open it: in your studio, press your name at the top right and choose Your account. On a phone, it is at the top of the menu.

Logging in from the Meridian site

Log in at the top of the Meridian site takes you to your studio.

1. Enter the email address you signed up with and press Email me a link.

(Or press Continue with Google, Microsoft or Apple.)

1. Open the email. The link works once and lasts thirty minutes.
2. You arrive already signed in, on your own domain if it is working, or on

your Meridian address if it is not live yet: - on the Studio plan, at your studio's Overview - on the Sites plan, at your website's pages - on the free plan, at your galleries.

If you have more than one site, the page asks Which studio? Press the button beside the one you want.

The page gives the same answer whether or not an email address has an account, so nobody can use it to find out who our customers are.

If you use a code as well as a password, the emailed link does not skip it. Your studio asks for the six-digit code from your app before anything opens.

If your plan has ended or is paused, you see a short message saying so, with a link to Your sites, where you can see what is kept and start it again.

You can also sign in directly at your own address followed by /studio, with your password. That page carries your studio's name and logo ("Sign in to" and your studio's name), with Powered by Meridian at the foot.

Team members

Team members do not have a Meridian account, so the emailed link is not for them. On the Log in page they open **Team member, or signing in with a password?** instead:

1. Type the studio's address (for example its website address).
2. Press Go to its sign-in. You go to that studio's own sign-in page.

Don't know the address? Open it, type your email and press **Email me my studio links**. If your email can sign in anywhere, we send you a link to each studio's sign-in page. The page says the same thing either way, so nobody can use it to find out where somebody works. To stop misuse, it takes ten tries in fifteen minutes from one place, and sends one address at most three emails an hour.

Team members should not press Continue with Google, Microsoft or Apple on the Meridian site: with an email that has no Meridian account, that starts a new free account instead.

Clients

Your clients never need to log in. They use the links you send them: their gallery, invoice or client page.

One login for both halves

If you have a Meridian website as well as a studio, they are one account. The same email address and password open both, and changing the password changes it for both. The Your account screen says so at the top.

Somebody you have invited to your team who has no website login has a studio sign-in of their own instead. See your team.

Change your details

Under Who you are, change your name or the email address you sign in with, then press Save. To change your email address you also need to type your Current password.

Your password

To change it, go to Your password, type The one you have now and **The new one, then press Change it**.

• At least twelve characters. Length beats punctuation, so a few words you will remember work better than a mangled word.
• A handful of obvious ones are refused outright, including anything containing "password" or "photography".
• Eight wrong attempts locks the sign-in for fifteen minutes. The lock lifts by itself; there is nothing to reset.

If you have forgotten it, press Forgotten your password? on the sign-in page. The link we email you works once and lasts two hours.

A code as well as a password

This is often called two-factor sign-in. Once it is on, signing in asks for your password and a six-digit code from an app on your phone.

1. Under A code as well as a password, scan the square with an

authenticator app: Google Authenticator, 1Password, Authy, whichever you already use.

1. Type the six-digit code the app shows into The code it shows.
2. Press Turn it on.

That last step is not a formality. It only switches on once a code has worked, so you can never lock yourself out with an app that was not really set up.

Some apps ask you to type a key in by hand instead of scanning. The key is on the same screen under Or type the key in by hand, and the account name is your email address.

Codes change every thirty seconds. A code from just before or just after is accepted too, so a phone clock that is slightly out does not lock you out.

This option is on the account that owns the website and studio. Team members with a studio sign-in only do not have it.

Recovery codes

Turning it on gives you eight recovery codes. Each one signs you in once, in place of a code from your phone.

They are shown once only. We keep them scrambled so that nobody, including us, can read them back, so we could not show them to you again if you asked. Print them, or save them in a password manager, before you leave the screen.

• The screen tells you how many you have left.
• New recovery codes replaces the whole set (you type a current code from your app to confirm). The old ones stop working straight away.
• Turn it off (again with a current code) switches the check off and deletes the recovery codes with it.

A phone gets lost, stolen and dropped in water. Keep at least one recovery code somewhere that is not your phone.

How long you stay signed in

A sign-in lasts up to a day, or eight hours if you have not used it, then asks again.

If you change somebody's role or remove them from your team, it takes effect on their very next click, not when their sign-in runs out.

What we can and cannot see

We cannot read your password or your recovery codes. If you lose both your phone and your codes, raise a ticket. We can help you prove who you are and start again, but there is no back door that skips that.