Platform Access

Symptoms covered on this page

You cannot sign in to Breach360.
Your authenticator app's codes are rejected.
You have lost the device with your authenticator app on it.
An invitation link does not work.
The platform loads partially, shows stale data, or behaves oddly after an update.

The platform is at https://aev.breachlocklabs.com/. POV (proof-of-value) customers sign in at https://aev-demo.breachlocklabs.com instead — the two are separate environments with separate accounts, and an account on one will not work on the other.

Your password is rejected

Passwords must meet all of these:

Between 8 and 64 characters
At least one upper case character
At least one lower case character
At least one special character
At least one numeric digit

If you are confident the password is right and it is still rejected, use the password reset link on the sign-in page rather than retrying — see the rate limit below.

After 10 failed attempts within 15 minutes, further attempts on that account are refused for the rest of the window. This is deliberate and it clears on its own: wait for the window to pass and try again, or reset your password.

It also means that repeatedly retrying a password you are unsure about is counterproductive. Reset it instead.

You have an account but no organization

An account that is not a member of any organization can sign in but has nothing to show. This normally means an invitation was never accepted, or was accepted with a different email address than the one you are signing in with.

Breach360 supports membership of more than one organization on a single account, so the fix is usually to accept the outstanding invitation while signed in with this address rather than to create a second account. Ask your organization's administrator to re-send the invitation if you no longer have it.

Multi-factor authentication

Breach360 uses time-based one-time passwords (TOTP). Any standard authenticator app works; Google Authenticator and Microsoft Authenticator are the two we test against. The account appears in your app as Breach360.

Your codes are rejected

Almost always a clock problem. A code is valid for its own 30-second period and one period either side, so roughly 90 seconds in total — which tolerates ordinary drift but not a device whose clock is minutes out.

Check the device's clock is set automatically. On iOS, Settings → General → Date & Time → Set Automatically. On Android, Settings → System → Date & time → Set time automatically.
In Google Authenticator, use the app's own time-correction option if your platform offers one.
Enter the code promptly. A code read at the very end of its period may expire between reading and submitting.
Check you are reading the right entry. If you have enrolled more than once — for example after a failed setup — your app may show two entries named Breach360, and only the most recent one works. Delete the stale entry.

You have lost your authenticator device

Use one of the recovery codes issued when you enabled multi-factor authentication. Each code works once. Sign in with a recovery code, then go to Settings → Security to re-enrol a new device; the remaining code count is shown there, and you can regenerate the set at any time — which invalidates every code from the previous set.

If you have no recovery codes left, an administrator in your organization can help, or contact support@breachlock.com. We will need to verify your identity before resetting multi-factor authentication on an account.

Store recovery codes away from the device they protect. Codes saved only on the phone running the authenticator app are lost in exactly the situation they exist for.

Setting up MFA does not complete

If the QR code will not scan, most apps accept the secret typed in manually — look for a "enter a setup key" or "manual entry" option. If the verification code is rejected during enrolment, the cause is the same clock problem described above; correct the device's time and restart the setup.

For step-by-step enrolment instructions, see Getting Started.

Invitations

Invitation emails link to a specific address. Two things trip people up:

The link must be opened by the invited address. Accepting while signed in as somebody else adds the organization to the wrong account.
Invitations are per-organization, not per-account. If you already have a Breach360 account, accepting adds the organization to it rather than creating a second account. Sign in with your existing address to accept.

If the link has expired or does not load, ask an administrator in the organization to re-send it rather than requesting a new account.

Browser problems

The platform is a single-page application, so a cached bundle from before an update can produce symptoms that look like a fault in the product: a page that will not load, a panel stuck on a spinner, or data that is visibly out of date.

Try a hard reload first

Windows and Linux: Ctrl + Shift + R
macOS: Cmd + Shift + R

Clear the site's stored data

If a hard reload does not fix it, clear what the site has stored locally. In Chrome or Edge:

Open developer tools — Cmd + Option + I on macOS, Ctrl + Shift + I on Windows and Linux.
Go to the Application tab.
Under Storage, choose Clear site data.

You will be signed out, which is expected. Sign in again afterwards.

In Firefox, the equivalent is Storage in developer tools, or clearing cookies and site data for the site from the address bar's padlock menu.

Try a private window

A private or incognito window loads the site with no stored state and no extensions. If the platform works there and not in your normal window, the cause is a cached bundle or a browser extension — content blockers and corporate browser extensions are the usual suspects, and adding an exception for the Breach360 hostname resolves it.

Supported browsers

Use a current version of Chrome, Edge, Firefox or Safari. Very old browser versions, and browsers in enterprise-locked configurations that disable modern JavaScript features, will render the platform incompletely.

Need help? If you cannot get into the platform after these steps, contact your organization's administrator first — many access problems are resolved by an invitation or a role change on their side. Otherwise, reach out to your BreachLock representative or email support@breachlock.com.