Skip to content
English
Customer portal
Contact us
  • There are no suggestions because the search field is empty.

09.02 Your Account and Profile

Manage your SimpleRisk profile — change your password, set your language, enroll in MFA, generate API keys, and reset custom display settings. Plus the candid story about which fields you can edit yourself versus which require an admin.

Why this matters

The profile page is where you manage the parts of your SimpleRisk account that belong to you — password, MFA enrollment, language preference, API keys (if the API Extra is active), and the reset-to-default action for any custom display settings you've accumulated. Most of the operational pages assume you've completed the basic profile setup once; the rare visit to the profile page after that is to update a password, enroll in MFA when the policy changes, or rotate an API key.

The honest story about the profile page in Core: most of your profile is read-only to you. Username, email address, manager assignment, team membership, role, and admin flag all display on the profile page but can't be edited there. Changes to those fields require an administrator (the user-management workflow lives in the Administrator Guide; see Managing Users, Teams, and Roles). The fields you can edit yourself are language preference, password, MFA settings, and API keys.

The other thing worth knowing: most of what you'd expect to live on a separate settings page is actually inline on the profile page itself. Changing your password, checking your MFA status, and managing an API key (when the API Extra is active) all happen right there on /account/profile.php, without a page reload. Enrolling in MFA is the one exception — that still walks you through its own page at /account/mfa.php, because the QR-code scan-and-verify flow needs the room.

Before you start

Have these in hand:

  • Login credentials for your SimpleRisk account.
  • For password change: your current password (required to set a new one).
  • For MFA enrollment: an authenticator app (Google Authenticator, Authy, 1Password, Bitwarden, etc.) installed on a device you'll have available when you log in.
  • For API key generation: a clear destination for the key. API keys are credentials that authorize programmatic access to SimpleRisk through the v2 API. Treat them like passwords — store securely, don't share, rotate periodically.

Step-by-step

1. Open your profile

The user account dropdown in the top-right of any page links to the profile. Or navigate directly to /account/profile.php.

The top of the page is a record header: your name and email address, and an Administrator badge if your account has admin rights. Below that, the page is laid out as a set of cards:

  • Account details — a read-only summary of the fields an admin manages on your behalf: Username, Manager, Teams, and Role.
  • Security — your MFA status and the button to enroll or disable it, the password-change form, and (if the API Extra is active) your API key controls.
  • Preferences — the Language dropdown (SimpleRisk supports 39+ locales via Crowdin; changing it saves to your account and reloads the page in the new language) and the Reset Custom Display Settings button.
  • Your permissions — a category-by-category view of what your role and teams grant you access to.

Everything in Account Details is read-only to you; everything in Security, Preferences, and Your Permissions is either something you can act on directly or a reflection of access someone else configured.

2. Change your password

Fill in the password form in the Security card: Current Password, New Password, and Confirm Password. As you type the new password, a checklist below the fields ticks off each of the install's configured requirements — minimum length, mixed case, a digit, a special character, whichever your admin has turned on — so you know before you submit whether it'll be accepted. If your account has MFA enabled, the form also asks for your current MFA code; a password change is sensitive enough that it gets the same step-up check as disabling MFA outright.

Submit the form. The new password is also checked against your password history to prevent reuse (the lookback window is admin-configurable); if it's rejected for any reason, the form tells you the specific rule it failed, not just that it failed.

On successful change, you stay logged in on this device, but every other session for your account is signed out — worth knowing if you're changing your password because a device was lost or a session might be compromised.

For lost-password recovery (you can't log in to access this page), the password-reset workflow goes through the login page's "Forgot Password" link or through an admin reset.

3. Enroll in MFA

Multi-factor authentication uses Time-based One-Time Password (TOTP) codes from an authenticator app. SimpleRisk's MFA support is built on the Google2FA library; any TOTP-compatible authenticator works.

To enroll:

  1. Click Enable MFA on the profile page (or navigate directly to /account/mfa.php).
  2. The MFA page shows a QR code and a base32 secret. Scan the QR code with your authenticator app (or manually enter the secret).
  3. The authenticator app starts generating 6-digit codes that rotate every 30 seconds.
  4. Enter the current 6-digit code from your authenticator into the verification field on the page.
  5. Submit. SimpleRisk verifies the code against the secret; if valid, MFA is enabled on your account.

From the next login forward, after entering your username and password, you'll be prompted for the current 6-digit MFA code.

To disable MFA (if your installation's policy allows it), click Disable MFA on the profile page. Some installations require MFA for all users (mfa_required setting in admin); on those installations, the disable action is unavailable.

4. Manage API keys (when the API Extra is active)

The API Extra adds the API key management section to your profile page. The section appears only when:

  • The API Extra is installed and activated by an admin.
  • Your account has the necessary permissions to use the API.

When visible, the section offers:

  • Generate API Key (this button relabels itself to Rotate API Key once you already have one) — creates a new API key for your account, invalidating any existing one. Use it the first time you need a key, when an existing key may have been exposed, or as part of routine credential rotation. The key appears once, in a box on the page immediately after generation; copy it to your password manager or other secure storage right away, because it can't be retrieved later (only the hash is stored).
  • Invalidate API Key — removes the key without generating a replacement. Use when you no longer need API access from your account.

If your account has MFA enabled, any of these actions prompts you for a current MFA code before it goes through. SimpleRisk stores only a hash of your API key, so the key itself is never recoverable from the application, and each user's key is scoped to that user's own permissions — it has the same access as the account that generated it.

For programmatic use, include the API key in the X-API-KEY header on requests to /api/v2/* endpoints.

5. Review your permissions

The Your permissions card lists what your role and teams grant you access to, grouped by category — Governance, Risk Management, and Compliance, among others. Each category is collapsed by default; click one to expand it and see the individual permissions you hold. A category shows an All granted badge next to its name when you hold every permission in it, so you don't have to expand it just to confirm full access.

Where does that list come from? Three things combine. Your role sets the starting permissions. Your administrator can then add or remove individual permissions for you alone, which is why you and a colleague with the same role can see slightly different lists. And your teams decide which records those permissions apply to when team-based separation is in use. If you're an Administrator, you hold every permission and belong to every team, so there's nothing to expand: you can do anything, everywhere.

This view is read-only: it reflects what your assigned role and team memberships already grant you, not a place to change them. If something's missing that you need, that's a conversation with your admin — see Managing Users, Teams, and Roles.

6. Reset custom display settings

As you use SimpleRisk, you accumulate per-user customizations: column orderings on datatables, dashboard widget arrangements, and similar UI personalizations. These are saved against your account (see Favorites and Personalization).

If your column selections have gotten messy or you want to start fresh, click Reset Custom Display Settings on the profile page. The button resets one shared column-selection setting back to its default — it doesn't touch your other saved customizations (dashboard layout, other tables' column choices, and so on), so those stay exactly as you left them.

The reset returns a confirmation: "Your custom display settings was reset successfully." (Note: the message has a singular-verb quirk in the source string.) The reset takes effect immediately; the next datatable you visit shows default columns.

7. Logout

The user account dropdown in the top-right offers Logout. Logout invalidates the current session; future access requires re-authentication (with MFA if enrolled).

For shared workstations, explicit logout is the safe pattern. SimpleRisk's session timeout is admin-configurable; users on long-lived sessions should still log out explicitly when stepping away from the device.

Common pitfalls

A handful of patterns recur with profile management.

  • Trying to change your own name or email and finding the field read-only. This is the most common surprise. The profile page displays your name and email, but you can't edit them yourself — those fields are administrative. If you need a name correction (legal name change, typo) or an email update, ask your admin via whatever process your organization uses for user-management requests.

  • Forgetting to copy the API key after generation. API keys display once at generation time and are stored only as hashes afterward. If you click away from the generation page without copying the key, it's lost — you'll need to rotate to get a new one. Copy to a password manager immediately.

  • Getting stopped mid-form by an MFA prompt you weren't expecting. If MFA is enabled on your account, changing your password or touching your API key asks for a current code from your authenticator before it'll proceed. It's not a bug; those are exactly the actions someone with a stolen session would try first, so they get the extra check. Keep your authenticator handy when you sit down to do either.

  • Enrolling in MFA without confirming the authenticator works. A common failure mode: scan the QR code, get distracted, navigate away from the page without entering the verification code, then discover at the next login that MFA is enrolled but the authenticator's secret was never confirmed. The verification step is the confirmation; complete it before leaving the MFA page.

  • MFA secret on a single device that gets lost. A single authenticator on a single device that gets lost or wiped means you can't log in. Either store the base32 secret in your password manager when enrolling (so you can re-create the authenticator on a new device), or rely on the admin's MFA-reset capability for recovery. Don't enroll MFA without a recovery plan.

  • Treating the language change as immediate everywhere. The profile page reloads itself in the new language as soon as the change saves, but pages already open in other tabs continue rendering in the previous language until refreshed. For consistent rendering across tabs, refresh those tabs too after changing the language.

  • Expecting the reset to fix every table's columns. Reset Custom Display Settings only restores the one shared column-selection setting to its default; it doesn't touch the separate customizations you've made elsewhere (other tables' column choices, dashboard layout). If those need fixing too, use that table's own column-customization control (most have a Settings cog or similar) rather than expecting the profile-page button to cover everything.

  • Generating API keys for accounts that don't need them. Every API key is a credential that grants access at the user's permission level. Generating keys for accounts that don't actually use the API expands the credential surface for no benefit. Generate keys only for accounts that genuinely use the API; rotate or invalidate keys you no longer need.

  • Ignoring the password-history rule. SimpleRisk's password history rejects passwords you've recently used. A common mistake is trying to "rotate" by setting the password back to a recent prior one; the history check rejects the change. Pick a genuinely new password each rotation.

Related