Signing in to the console

The customer console is dash.fingertrackid.com. Each person uses a named account. The server checks identity, email, authenticator and current access; a correct password alone does not open the console.

The console, including sign-in, recovery and authenticator screens, is in Portuguese (pt-BR). Labels below are quoted exactly as shown, with an English gloss.

First access

When your account is created, FingerTrackID sends you an invitation email (in Portuguese) with an Ativar acesso (activate access) button. The email is sent on a best-effort basis. If the activation link cannot be generated, the invitation comes instead with an Abrir o console (open the console) button and tells you to use Esqueceu sua senha?: in that case start at step 2.

Open the invitation and choose Ativar acesso (activate access). On the Ativação de acesso page, enter Nova senha (new password) and Repita a nova senha (repeat it), then choose Ativar acesso. This sets your password and confirms your email in one step. The link is personal and works only once; opening the page does not use it up.
If the email did not arrive or the page says the link is invalid, expired or already used, open the console and choose Esqueceu sua senha? (forgot your password?). Enter your E-mail, complete the anti-bot check if shown and choose Enviar link (send link). FingerTrackID emails you a link from no-reply@fingertrackid.com. The confirmation is the same whether or not the email exists. At most one email per address is sent in each fixed 15-minute window (for example, 10:00–10:14), so a second request in the same window sends nothing; wait for the next window.
If you used Esqueceu sua senha?, open the emailed link. On Escolha uma nova senha (choose a new password), enter Nova senha and Repita a nova senha, then choose Trocar a senha (change password). This only sets your password; it does not sign you in. Return to Entrar no console (sign in) and enter your E-mail and Senha (password).
If Confirme seu e-mail (confirm your email) appears, choose Enviar e-mail de confirmação, open the link it sends, then return and choose Já confirmei meu e-mail (I already confirmed my email).
On Configure o autenticador (set up the authenticator), scan the QR code with your authenticator app (or type the key shown). Enter the six-digit code in Código do aplicativo autenticador and choose Cadastrar e entrar (enroll and sign in). An anti-bot check may be required.

Older accounts that were issued an initial password see Troque a senha inicial (change the initial password) before any data opens: enter the current password, a different new password twice and your authenticator code. The change ends the session; sign in again with the new password.

Password policy

The password must have 15 to 4096 characters, including a lowercase letter, an uppercase letter, a digit and a special character. When a password is refused, the console lists only the missing requirements.

Later sign-ins

Enter email and password, then the six-digit code from your authenticator.
If you enrolled more than one authenticator, select the one you are using before entering its code.
Codes are accepted within a 90-second window. Repeated refusals usually mean the wrong authenticator or a device clock that is off.
Sending a request (applications, collection setup, members, integration clients) or changing your own settings uses the session you signed in with; it does not ask for your password or code again. A request is normally approved when you send it, recorded in the audit trail and applied by the managed process; FingerTrackID can cancel it before the executor takes it.
Every other action (policy, lists, exports, reviews, outcomes) also uses the session you signed in with: it does not ask for your password or code again. Your role still decides what you can do, and every action is recorded in the audit trail.
A console session ends after 30 minutes without activity or 12 hours after sign-in.
A revoked, suspended or expired membership is refused even if your password and code are correct.

Password recovery

Use Esqueceu sua senha? on the sign-in screen, as in step 2 above. Recovery changes your password and keeps your authenticator: an email link never replaces the second factor. Expired or already-used links are refused; request a new one. Do not share the link.

Lost authenticator

Contact contato@fingertrackid.com for a separate, identity-verified recovery. There is no self-service removal of the second factor by email. An authorized operator blocks the account’s existing access before resetting it; you then set a new password, verify your email and enroll a new authenticator. Never send passwords, keys or codes to support.

To avoid this, add a second authenticator in Conta e segurança (account and security) with Autenticador reserva (backup authenticator).

Account and session

Conta e segurança shows your email, display name and time zone, session expiry and security settings. There you can:

Editar preferências (edit preferences): change Nome de exibição (display name) and Fuso (time zone); both are saved together. Preferences never change a role.
Trocar a senha (change password): current password, new password twice and your authenticator code. The change ends the session.
Autenticador reserva: add a backup authenticator after confirming your current password and authenticator.

The sign-out button in the top bar, Sair do console, ends this session and every other session of your account once the server confirms it. If the console says the server did not confirm the sign-out, only this browser was signed out; on a shared computer, close the browser and sign out again later.

If you belong to several companies, choose the company in the top bar before reading its data. Switching company or application clears the previous view. Access granted while you are signed in appears after you sign out and sign in again.

Internal backoffice

FingerTrackID’s own operators use a separate internal backoffice, protected by Cloudflare Access and the same password and authenticator checks. Customer accounts cannot enter it.

In the backoffice, an operator only creates a company and its first administrator. Everything else — applications, members, server clients, the initial setup and browser collection — is done by your company in the console. Operators follow your progress and intervene only when needed, for example to cancel a request, revoke access, recover an account, or suspend or archive a company.

Backoffice actions use the session established at sign-in with password and authenticator; they do not ask for the password or code again, within the same session limits. A request the operator submits in the backoffice is approved by the same operator in the same operation and recorded in the audit trail.

See production status.