Securing your account

What is it for?

Your Billora account contains your clients, your invoices and your bank details. Someone logging in in your place would see all of it. A few two-minute settings are enough to prevent that.

Example. Réda sometimes uses a cybercafé computer in Agadir. He has enabled two-step verification: even if someone guessed his password, they would lack the six-digit code shown on Réda's phone.

1. A strong password

At least 8 characters, with an uppercase letter and a digit (128 characters maximum). Prefer a long phrase that only makes sense to you.
A password reserved for Billora. Do not reuse it elsewhere.
No recent reuse. Billora refuses a new password identical to one of your last three: "Ce mot de passe a déjà été utilisé récemment. Choisissez-en un nouveau." (This password was used recently. Choose a new one.)

Change your password

On the login page, click Mot de passe oublié ? (Forgot password?)
Enter your email then click Envoyer le lien de réinitialisation (Send the reset link).
Open the email received: the link is valid for 1 hour. Choose your new password.

Good to know

Resetting logs out all your devices (browsers and phones): they will have to log in again with the new password. This is exactly what you need if in doubt.

2. Two-step verification (2FA)

With 2FA, knowing the password is no longer enough: you also need a 6-digit code. It is set up in Paramètres → Sécurité (2FA) (Settings → Security (2FA)). This page is open to all roles: everyone protects their own access.

Two methods exist, but only one can be active at a time:

Method	How it works	Level
Application Authenticator (Authenticator app)	An app on your phone (Google Authenticator, Authy, 1Password…) displays a 6-digit code renewed every 30 seconds.	Recommended
Vérification par email (Email verification)	A 6-digit code is sent to you by email at each login.	Less secure: anyone who accesses your mailbox also receives the code.

Enable the Authenticator app

In the Application Authenticator section, click Configurer (Set up).
Install an authentication app on your phone, then click Suivant (Next).
Scan the QR code with the app. If the camera does not work, use Saisir la clé manuellement (Enter the key manually).
Enter the 6-digit code shown in the app, then your password to confirm, and click Confirmer (Confirm).
Billora displays your backup codes: copy them with Copier tous les codes (Copy all codes) and keep them in a safe place (password manager, safe, paper stored away).

A green Actif (Active) badge confirms activation. At each login, after the password, the "Vérification en 2 étapes" (Two-step verification) page asks you for the code.

Keep your backup codes

Each code can be used only once. If you lose your phone, they are the only way to log in without support's help. On the verification page, use the link "Vous n'avez pas accès à votre téléphone ? Utiliser un code de secours" (Can't access your phone? Use a backup code). You see the number of remaining codes in the section, and the Régénérer (Regenerate) button creates new ones (the old ones become unusable).

Enable email verification

In the Vérification par email section, turn on the switch and confirm with your password. At login, click Envoyer le code (Send the code) to receive the 6-digit code. If the Authenticator app is active, this option is greyed out ("Désactivez TOTP d'abord", Disable TOTP first).

Disable 2FA

The Désactiver (Disable) button asks for your password. Doing so without reason is not recommended.

3. Connected devices

On the same page, the Navigateurs connectés (Connected browsers) section lists the computers and browsers open on your account, and Appareils mobiles connectés (Connected mobile devices) the phones where the app is logged in. A login stays valid for 30 days.

Déconnecter (Log out) on a row: cuts that specific device (within the minute for a browser, within the hour for a phone).
Déconnecter les autres navigateurs (Log out other browsers): all except the one you are using.
Déconnecter tous les appareils (Log out all devices): all your phones (your browsers are not affected).

Good to know

After using a shared computer, log out with the menu at your name (top right) then Déconnexion (Log out). Check the device list from time to time: a row you do not recognise is a warning sign.

4. If you get it wrong too many times

After 5 failed attempts, the account is temporarily locked for 15 minutes: "Trop de tentatives échouées. Réessayez dans N minutes." (Too many failed attempts. Try again in N minutes.) This protection also hinders anyone trying to guess your password. Simply wait for the delay to end, or use Mot de passe oublié ?

5. If you suspect unauthorised access

Reset your password immediately (see above): this logs out all devices.
Enable two-step verification if not already done.
Check the Journal d'activité (Activity log) to spot actions you did not take.
If a colleague has left the company, deactivate them in Paramètres → Membres (Settings → Members) (see Team roles and access): deactivation is immediate.
Write to support at contact@billora.ma describing what you noticed.

Frequently asked questions

I lost my phone with the Authenticator app.

Log in with a backup code, then regenerate new ones and set up the app again on your new phone. Without a backup code, contact support.

I am not receiving the email code.

Check your spam folder; a resend is possible after a short delay. Otherwise use a backup code (link "Vous ne recevez pas le code ? Utiliser un code de secours", Not receiving the code? Use a backup code).

Is 2FA mandatory?

It is optional for company accounts, but strongly recommended. (It is mandatory for Billora platform administration accounts.)

Can my read-only colleague enable 2FA?

Yes: the Security page is open to all roles.

Next steps

Manage roles and access → Your data and privacy →