Sign-in

The app signs in to an account only through the Profit Cloud Telegram bot and a second factor. The account has no password. One app holds up to three accounts.

Telegram

1. The "Telegram" button on the "Sign in to Profit Cloud" screen opens the bot through a one-time link.
2. The app shows a verification code like ABC-D2E. The bot sends a "Confirm sign-in" card: the device (app version, system, device name) and the same code. If the code differs or you did not start the sign-in, tap "❌This wasn't me": this sign-in is canceled.
3. Tap "Sign in" in the bot; the sign-in then completes in the app. You have up to 5 minutes to confirm.

Registration in the bot has to be finished first. On the first sign-in, while no email is linked, the bot asks for an email address before "Sign in": it deletes the message with the address and sends a code to that email.

Second factor

• An authenticator is connected — a code from the authenticator app: 6 digits, a 30-second step; the same code cannot be used twice. No email is sent in this case.
• No authenticator — a code from the email "Your Profit Cloud sign-in code": 6 digits, valid for 10 minutes. The email contains the device, the time and a "Freeze account" button.

The number of code entry attempts and of emails with codes is limited.

The app receives the session key only after the last step: a sign-in abandoned halfway leaves no session. A session expires after 30 days without use.

After the first sign-in and on every new device, the app requires a passcode. Signing in is also allowed during a freeze — the account stays frozen.

Each sign-in creates a session and sends "🔐 New sign-in" to Telegram — the device, time, IP and country; authenticator owners also get an email. This notification cannot be turned off.