RotorLab logo RotorLabDocs

Accounts and signing in

RotorLab is multi-user: every person signs in, belongs to an organization, and keeps a private build library. This page covers the whole account lifecycle, from registration through two-factor authentication, and explains the three roles in plain terms.

Creating an account#

Pick a plan on the pricing page first; the registration form at https://rotorlab.app/register shows the plan you chose at the top, with a Change plan link back to pricing.

The form asks for:

  • Organization / company, Your name, and Email (all required). The email you enter becomes the organization admin account.
  • Billing details (contact, address, country, tax or VAT ID). These are used for invoicing and passed to the payment processor at checkout. They are optional on free and trial plans.

Pick the country before filling the rest of the address. Every country is listed, and the fields below rearrange to match it: the region field takes that country's own name (State, Province, Prefecture, County) and becomes a picker where a standard list exists, countries that do not use a region in a postal address do not show the field, and countries with no postal system are not asked for a postal code. The postal code is checked against the country's format when you continue, and an address that cannot be right is refused with the offending field highlighted rather than being stored and failing later at checkout. See org billing for changing any of this afterwards.

Before you can continue you must tick the acceptance checkbox confirming you have read and agree to the Terms of Service, End User License Agreement, Acceptable Use & Drone Operations Policy, and Privacy Policy (each opens in a new tab from the form). The server refuses registration without this acceptance, and it records the version of the documents you agreed to, so a material update can ask you to re-accept.

What happens after Continue depends on the plan:

  • Free or trial plan. The account activates immediately and RotorLab emails you a link to set your password.
  • Paid plan. You are taken to secure checkout, and the account activates automatically once payment is confirmed.

Your team may already be here

If an organization already exists under your email domain, the form offers Request to join instead, so an admin can add you rather than starting a duplicate organization.

Signing in#

Sign in at https://rotorlab.app/login with your email and password. Links under the form lead to the password reset page and to plan selection for a new account.

Repeated failed sign-ins are throttled: after too many failures in a short window, further attempts are refused with "Too many attempts. Try again later." The lockout clears on its own after a few minutes, and a stranger failing sign-ins against your email cannot lock you out.

Resetting a forgotten password#

  1. Press Forgot your password? on the sign-in page (or open https://rotorlab.app/reset).
  2. Enter your email and submit. The page answers the same way whether or not the account exists ("If that account exists, a reset link has been sent"), so addresses cannot be probed.
  3. Open the emailed link. It leads to a set-password page asking for the new password twice; passwords must be at least 8 characters.
  4. The link is single use and expires. Setting the password signs you out everywhere, so sign in again with the new password.

The same set-password page handles invitations: when an admin creates your account, the invite link you receive ends at this page.

Changing your password#

Open the Menu and choose Change Password (https://rotorlab.app/change-password). Enter your current password and the new password twice, then press Update password. Changing your password revokes your sessions, so other browsers where you were signed in are signed out.

An administrator can also require a password change. When that flag is set, the app sends you to the change-password page at sign-in and the page says "You must set a new password before continuing."

Two-factor authentication#

RotorLab supports time-based one-time passwords (TOTP): a 6-digit code from an authenticator app that changes every 30 seconds. It is an open standard, so Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and any other TOTP app all work. Nothing is sent to a third party.

To turn it on:

  1. Open My Account and find the Two-factor authentication card.
  2. Press Set up two-factor. A QR code appears; scan it with your authenticator app, or type the printed secret in manually.
  3. Enter the 6-digit code the app shows and press Turn on. Two-factor is not active until a code proves your authenticator holds the secret, so abandoning setup halfway cannot lock you out.
  4. Save the recovery codes shown next. They are displayed exactly once, stored only as hashes, and each works one time. New recovery codes issues a fresh set later (invalidating the old set), and Turn off disables two-factor after you confirm your password.

With two-factor on, signing in becomes two steps: a correct password does not start a session by itself. The sign-in page asks for the code from your authenticator, and no session cookie is issued until it is accepted. Lost your phone? Enter one of your recovery codes in the code field instead; the page tells you when one is spent and how many remain.

Organization admins can require two-factor for everyone in the organization, with a grace period of 0 to 365 days (default 14) for people to enroll. Someone who joins after the policy starts gets the full grace period from their own start date.

Sessions#

Sessions ride HttpOnly, SameSite=Strict cookies, and the server stores only a hash of the session token. Sessions are revoked when your password changes and when an account is deactivated.

Roles#

  • Organization admin manages users and settings within one organization, including the two-factor policy.
  • Member (standard user) owns their own builds and records. Members see only their own builds; builds are private unless their owner shares them.