Authentication & Recovery Codes
Signing in, two-factor recovery codes, and what to do if you're locked out
Turning two-factor sign-in off
Go to Settings → Me and find Sign-in security. If you have no authenticator app or passkey set up, turn off Email sign-in codes.
Greenroom asks Turn off two-factor sign-in? and explains: "Signing in will need only your password. You won't be asked for an email code." Click Turn off to confirm.
The saved change appears under your name on Settings → Activity as Two-factor sign-in turned off. Greenroom also emails your sign-in address with the subject "Two-factor sign-in was turned off for your Greenroom login".
The notice says: "Didn't make this change? Reset your password from the Greenroom sign-in page and contact support@greenroompayroll.com right away so we can help secure your account." It contains no links.
If you have an authenticator app or passkey set up, Email sign-in codes controls your email fallback, and two-factor sign-in stays on. To turn two-factor off, first remove your authenticator app and all passkeys. Removing an authenticator app or a passkey asks for your password and signs out your other devices. When neither remains, email codes come back on if that fallback was off; you can then turn them off with the confirmation above.
Recovery codes
Greenroom supports recovery codes as a second-factor fallback, so a lost phone or a locked-out authenticator app doesn't have to mean a locked-out account. From Settings → Me, under Sign-in security, you can:
- See how many of your 10 recovery codes are still unused
- Generate a set (or regenerate a full new set if you already have one)
- Turn Email sign-in codes on or off as a fallback while an authenticator app or passkey is set up — turning that fallback off requires your password and at least one unused recovery code
Generating or regenerating codes asks you to re-enter your password first — that way a session left open on a shared computer can't mint a new set on its own.
Regenerating replaces your entire set at once — every old code, used or not, stops working immediately. Store the new codes somewhere safe before closing the page; Greenroom cannot show them to you again after you navigate away.
Each code works exactly once, even if it's submitted twice at nearly the same time — only the first attempt succeeds, and the second is rejected the same way a wrong code would be.
If you're locked out
If you've lost your authenticator app, the sign-in screen that asks for its code has a way round it. While email sign-in codes are on (the default), Email me a code instead sends a one-time code to your email; the screen says "Lost your authenticator? Your email is always a way in." If you have saved recovery codes, Use a recovery code takes one of those instead, which is the way in once you've turned email codes off.
If you've lost your second factor and have neither email codes nor a saved recovery code, contact Greenroom support. They can verify your identity and help restore access. Do not share a recovery code with anyone, including support staff; Greenroom will never ask you for one over email or phone.
For administrators
Recovery codes, authenticator apps, and passkeys are all scoped to the individual account that owns them — company managers don't have a way to view, reset, or regenerate a teammate's sign-in methods from inside Greenroom. That's a deliberate boundary, not a gap: it means one careless or compromised account on your team can't be used to reach into another. If someone on your team is genuinely locked out, have them contact Greenroom support directly rather than looking for an in-app override — recovery in that situation is handled and verified by Greenroom's own team.
How your data is protected
Greenroom is multi-tenant. Every request the application serves is scoped to the signed-in user's own company, so the product itself never lets one company read or write another's payees, pay rates, or tax data. As a second, independent layer, the database enforces that same boundary on its own: row-level security is enabled on every table, so nothing outside Greenroom's application — including the database's general-purpose data API — can read or write your data by default.
This section describes current architecture, not incident history. If you have specific compliance or security-review questions (SOC 2, data-processing agreements, penetration test results), contact Greenroom directly — that level of detail belongs in a signed agreement, not a public docs page.
Union Reports
The union remittance report on the Reports page, and how it's different from the Union Reports step inside a payroll run
Company Settings
The Settings tabs, where your company's setup lives before and after approval, what the Company tab holds before approval and its four groups after, and the Activity feed