Pick a door
| Method | Where | Use it when |
|---|---|---|
| Password | /sign-up | You want a credential you control and MFA on top of it. |
| Magic link | /sign-in | You would rather not have another password. The link is one-time. |
| /sign-in | Your company is on Google Workspace. Fastest path. | |
| Invitation | /invite/<token> | Somebody already added you to an organisation. |
| Module door | /sign-up/<module> | You came from a page about one specific application. |
Create your account
30-day trial, no card
Verify your email
A verification mail goes out immediately from SendGrid. Until you click it, the account exists but is unverified, and some destructive actions are withheld. If it never arrives, check the spam folder first and then read the warning below — it is the cause more often than a delivery failure.
Security gateways fetch every URL in an inbound message to check it. A magic link is single-use, so the scanner's fetch consumes it and your click lands on "this link has expired". In our own data the scanner's visit looks exactly like a successful login. If magic links keep failing on a particular domain, use a password or Google instead — it is not something we can fix from our side.
For the same reason the sign-in form never tells an attacker which addresses are registered, it never tells you either: it says "sent" whether or not there is an account behind the address. If you are waiting on a link for an address nobody has ever registered, you will wait forever and the screen will look fine. Create the account first.
Turn on two-factor
MFA is TOTP — Google Authenticator, 1Password, Authy, anything standard. Set it up in Settings → Security. You scan a QR code, confirm one code to prove the clock agrees, and it is on. Disabling it requires a current code, not just your password.
At app.erp.io/settings/security.
Any TOTP app. If the QR will not scan, the secret is shown as text beneath it.
This is the step that catches a phone with a wrong clock, which is the usual cause of "my codes never work".
Losing the authenticator with no recovery means mailing [email protected] and proving who you are. Do not skip this.
Sessions
The same Security page lists every active session with its device and last-seen time, and lets you revoke any of them. Because the whole suite shares one origin and one cookie, revoking a session signs you out of every module at once — which is the behaviour you want from a laptop left on a train, and worth knowing before you click it on the machine you are sitting at.
What this does not do
WebAuthn and passkeys are not implemented. TOTP is the second factor.
Deliberately. SMS is the weakest common second factor and adds a telephony dependency to sign-in.
Mail [email protected]. An account is usually a member of an organisation with data attributed to it, and silently orphaning that is worse than a support ticket.
Questions
Can I change my email address?
Yes, in Settings → Profile. The new address has to be verified before it becomes the sign-in identity.
I signed up with Google — can I add a password?
Yes. Use the forgot-password flow against the same address and set one.
Does one account work across several companies?
Yes. One account, many memberships, an organisation switcher in the shell. See Organisations.