Security & your account

Signing in and keeping your account safe

Simple habits that protect your school's records.

• Use a password that is long, different from your other accounts and not shared with anyone, including colleagues.
• Administrators: turn on two-step sign-in. It is the single best protection for your school's account.
• Sign out when you use a shared or public computer.
• Only sign in from your school's own address (the one that looks like app.lumbyte.com/your-school). Check the address before you type your password.
• Lumbyte will never ask you for your password, or a code from your authenticator app, by email, phone call or chat. If someone does, it is not us.
• If you think someone else has your password, change it straight away from My Account or Settings → Security, and tell your school administrator.

Two-step sign-in (authenticator app)

Add a second check to your sign-in so a stolen password is not enough.

With two-step sign-in, signing in needs two things: your password and a 6-digit code from an authenticator app on your phone. The code changes every 30 seconds, so a password alone cannot open your account.

It is available to school administrators and Lumbyte staff. We recommend every administrator turns it on.

Turn it on

1. Install an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy.
2. Sign in and open Settings → Security.
3. Under Two-step sign-in, choose Set up two-step sign-in.
4. In your app, scan the picture shown on screen. If you cannot scan it, type the setup key under the picture instead.
5. Type the 6-digit code your app now shows, and choose Turn on.
6. Save your recovery codes (see below). They are shown only once.

Signing in afterwards

Enter your email and password as usual. Lumbyte then asks for the 6-digit code from your app. Type it and you are in.

Recovery codes and a lost phone

What to do if you cannot use your authenticator app.

When you turn on two-step sign-in you receive a set of one-time recovery codes. Each code can be used once in place of the 6-digit code, for example if your phone is lost, broken or stolen.

• Save them somewhere safe and separate from your phone, such as a password manager or a printed copy in a locked drawer.
• To use one, type it into the code box on the sign-in page instead of the 6-digit code. It then stops working.
• Running low? In Settings → Security choose New recovery codes. This needs your password and a current code, and it cancels the old set.
• No phone and no recovery codes? Contact Lumbyte support from the contact page from the email address on the account. We will verify who you are before helping, and this can take a little time. That is on purpose, to protect your school.

Turn two-step sign-in off or change phones

Switch it off, or move it to a new phone.

1. Open Settings → Security.
2. Choose Turn off.
3. Enter your password and a code from your app (or a recovery code) to confirm.

To move to a new phone, turn two-step sign-in off and then set it up again on the new phone. We suggest doing this while you still have the old phone with you.

I forgot my password

Get back in with a link sent to your email.

1. On your school's sign-in page choose Reset it with your email (or open app.lumbyte.com/forgot-password).
2. Enter the email address you sign in with.
3. Open the email we send and choose Choose a new password.
4. Pick a new password and sign in with it.

• The link works once and expires after about an hour. If it has expired, ask for a new one.
• Check your spam folder if you cannot find the email.
• For your privacy the page gives the same message whether or not the email has an account, so you will not be told either way.
• Lumbyte never emails you your password, only a link to choose a new one.
• If you use two-step sign-in, resetting your password does not turn it off. You will still need your code.

Students: getting a new password

Student logins use a school-made address, so the school helps.

Students sign in with a login created by the school, which cannot receive email. If a student forgets their password, ask a parent or the school office. When a student was enrolled with no parent, the school was shown the login once at enrolment, so check with the school office. The school can send a request to Lumbyte through Support Tickets, and a temporary password is arranged. The student then chooses their own the first time they sign in.

Your first sign-in with a temporary password

New accounts must set their own password straight away.

When a school adds a teacher, a parent or a student, the account starts with a temporary password. The first time you sign in, Lumbyte asks you to choose your own password before anything else opens.

1. Sign in with the email and temporary password you were given.
2. On the Choose your password screen, type the temporary password once more, then your new password twice.
3. Save. You go straight to your dashboard, and the temporary password stops working.

Choose a password only you know. It needs at least 8 characters with a capital letter, a small letter and a number.

My account says it is locked

Why it happens and how to get back in.

To protect accounts from guessing, Lumbyte locks an account for a short time after several wrong passwords or codes in a row. It unlocks by itself after a few minutes.

• Wait a little, then try again with the correct details.
• Faster: use Reset it with your email to choose a new password. That unlocks the account straight away.
• If you are being locked out and you did not make those attempts, change your password, and tell your school administrator or Lumbyte support.

Administrators: reset a teacher's or parent's password

Send a reset link. You never see their password.

1. Open Teachers → Teacher Profiles and choose the teacher.
2. Choose Reset password and confirm.
3. The teacher's old password stops working and they are emailed a one-time link to choose a new one.

You can also use the ⋯ button on a teacher's card in Teachers → All Teachers, then Send password reset link. Nobody at the school, and nobody at Lumbyte, ever sees a teacher's password. For a parent, open the parent and press Send reset link. For a student, the school raises a request through Support Tickets.

Change your password

Every role can change their own password.

Open My Account (teachers and students), Account Settings (parents) or Settings → Security (administrators), enter your current password and choose a new one of at least eight characters with a capital letter, a small letter and a number.

Who can see what

Four roles, each limited to what they need.

• Administrators manage the whole school.
• Teachers see only their assigned classes and subjects.
• Parents see only their own children. When both parents have an account, each sees their child, and neither sees anyone else's.
• Students see only their own record.
• A parent's identification number, uploaded identification copy and emergency contact are visible to school administrators only.

Schools are completely separate from each other. Custom roles and permissions are not available yet. See the roadmap.

The audit log

A record of important changes.

Settings → Audit Logs lists important actions at your school, such as enrolling a student, changing a password, turning two-step sign-in on or off, or paying for a plan, with who did it and when. You can search it. If you see something you do not recognise, change your password and contact us.

Your data, exports and backups

It is yours, and it is kept safe.

Your school's data stays yours. Open Settings → Data.

Download

• Student list: name, email, admission number and class (CSV).
• Payments ledger: every payment with its receipt number and method (CSV, opens in Excel).
• Full data backup: a JSON copy of your school's records.

Bring people in

Download the template for students or teachers, fill it in, and choose the file. The first row must stay as it is. After the import you can download the one-time logins that were created. They are shown only once. See Import many students from a spreadsheet.

Start over

Use Request a reset if you need to clear a school's records, for example after a trial. Write a reason and send it. A Lumbyte developer reviews every request, and nothing is deleted until it is approved.

Lumbyte also keeps verified backups of the platform every night.

Report a security concern

How to tell us if something looks wrong.

If you think your account was accessed by someone else, or you received a message pretending to be Lumbyte, tell us straight away from the contact page, using the email address on your account. Please do not include your password or a code in your message. We will never ask for them.