Sign-in and access recovery

The primary way into X7 Insight is email and password. An administrator creates your account: you receive an invitation email with a link where you set your own password. If your organisation has connected single sign-on (SSO), the sign-in page additionally shows a “Sign in with SSO” button.

First sign-in: the invitation

1. An administrator creates your account and sends an invitation to your work email.

2. Open the “You are invited to X7 Insight” email and follow the link. The link works once and for a limited time; if it has expired, ask the administrator to resend the invitation.

3. Choose a password (at least 12 characters, different from your email) and confirm it. You are signed in right away — no separate sign-in needed.

Regular sign-in

1. Enter your email and password on the sign-in page and press “Sign in”.

2. When signing in from a new device or browser, the system emails you a 6-digit confirmation code. Enter it — the device becomes trusted and the code will not be asked again.

3. If your organisation requires a second factor (or you set one up yourself), enter the current code from your authenticator app.

4. If your email is registered in several organisations, choose which one to enter.

What the second factor is (MFA / TOTP)

The second factor is a one-time 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password and similar). On first setup the system shows a QR code and the secret once; afterwards it asks for the current code. You can also enrol in advance — in the “Security” section of your profile. Two independent factors are a strong-authentication practice supporting the access-control expectations of 21 CFR Part 11 and Annex 11 (the norms themselves do not mandate MFA for login).

Forgot your password

Press “Forgot your password?” on the sign-in page and enter your account email. If such an account exists, an email with a one-time link to set a new password arrives. After the reset all other sessions are signed out — other devices must sign in again.

When sign-in fails

• “Wrong email or password” — the system deliberately does not say which one failed. Check the keyboard layout and use “Forgot your password?”. - “Too many attempts” — after several failures sign-in is temporarily locked; wait and retry. - “The code did not match” — the emailed code has a limited lifetime; start over to get a fresh one. For the authenticator code, check the phone clock. - “Password expired” — your organisation’s policy requires a new password; the reset link has already been emailed to you.

Profile → “Security”

Your profile has a “Security” section:

• change password (the current password is required; other sessions are signed out);
• second factor setup (a QR code for the authenticator app);
• active sessions — a list of your sign-ins (when, from which address) and a “Sign out on other devices” button.

Single sign-on (SSO) — an organisation option

If the organisation has connected an identity provider (OIDC), the sign-in page shows a “Sign in with SSO” button: you confirm your identity in the corporate system, and the second factor is only asked when the provider did not already assert it. No X7 Insight password is needed.

A signature is a separate authentication

Signing in and applying an electronic signature are not the same thing. Every electronic signature requires re-authentication at the moment of signing: a password user re-enters the password, an SSO user re-authenticates with the provider. That is a Part 11 requirement: a session sign-in is not enough for a legally binding signature. See Electronic signatures.

Development mode (reference builds only)

On demo and test builds the sign-in page additionally shows a “Development mode” panel: instead of a password you provide a principal id (the X-Debug-Principal header) — handy for demonstrating different roles. Demo accounts also have a regular password (printed by make seed), so password sign-in works there too.

Caution

Development mode exists only on reference builds and test stands. Production deployments refuse to start with it enabled. If you see the “Development mode” panel on a production system — tell your administrator.