How you sign in

kymeer SaaS users sign in at app.kymeer.com in two steps: a one-time code sent to your email address, then a code from your authenticator app. kymeer has no passwords, so there is no password to reuse, phish or reset.

How does sign-in work?

Step	How it works
1. Email one-time code	Enter your email address and kymeer emails you a six-digit code. The code works once and expires after 10 minutes.
2. Authenticator app (TOTP)	Enter the six-digit code from your authenticator app. This second factor is required for every user.

The first time you sign in, kymeer asks you to set up an authenticator app before it gives you a session. When you confirm the first code, kymeer shows you 10 recovery codes. Keep them somewhere safe: each one works once, in place of an authenticator code.

New tenant administrators receive a welcome email that tells them to sign in this way. kymeer never sends a temporary password.

Why did I not receive a code?

Check the address you entered. kymeer gives the same response whether or not an account exists for an address, so the sign-in screen cannot tell you that the address is wrong. Code requests are also rate-limited for each address.

What happens after repeated failed attempts?

• Email code. Each code accepts five attempts. After that, request a new code.
• Authenticator and recovery codes. Five wrong codes in a row lock the second step for 15 minutes. Wrong authenticator codes and wrong recovery codes count towards the same lock, and a recovery code entered while you are locked is not used up.
• Rate limits. Sign-in requests are rate-limited as well.

What if I lose my authenticator?

• You have a recovery code. Enter it on the authenticator step. Each code works once.
• You are locked out. Wait 15 minutes, or ask for an unlock. A kymeer platform administrator can unlock any user; an MSSP administrator can unlock users in the MSSP's own tenants.
• You have no device and no recovery codes. A kymeer platform administrator can reset your second factor after confirming the request with their own authenticator code. The reset removes your authenticator and recovery codes, signs you out everywhere and emails you; you set up a new authenticator at your next sign-in.

Unlocks and resets are recorded in the audit log.

How are sessions protected?

• Each session is an opaque, randomly generated 256-bit token held on the server. Your tenant and roles come from that server-side record, never from the request.
• The token travels only in a cookie marked HttpOnly, Secure and SameSite=Strict. It is never returned in a response body.
• Requests that change data carry a separate CSRF token (double-submit cookie).
• Sessions expire after eight hours by default. Signing out revokes the session on the server.

How do partners sign in to the partner portal?

The partner portal uses the same kymeer sign-in: an email code, then your authenticator code. The portal does not store codes.

Partner roles are held separately from SOC roles. Accounts created through a partner application hold no SOC roles, so they cannot act inside a customer's SOC.