Changing your password
Enter your current password, then the new one — 8 characters minimum, checked against known leaked passwords. If you signed in with Google or LinkedIn there is no Whetstone password to change; manage it with them instead.If too many sign-in attempts fail
After 10 failed attempts within an hour, the account is locked. Failed sign-ins, failed password resets and failed two-factor recovery codes all count towards the same total — they are three ways at the same door.A locked account does not unlock itself on a timer. A timer would only tell someone guessing how long to wait. The Whetstone team is alerted the moment it happens, and a conversation with you is what lifts it — reply to any Whetstone email.
Two-factor authentication
Strongly recommended, especially for advisors receiving payouts.1
Enable it
Choose Enable two-factor in your account settings.
2
Scan the barcode
Use an authenticator app — Google Authenticator, Microsoft Authenticator, Authy and 1Password all work. If you cannot scan, type in the key shown underneath.
3
Confirm
Enter the 6-digit code the app shows. From then on, signing in asks for your password and a fresh code.
- Save them somewhere that is not your phone — a password manager, or printed with your important papers
- Each one works once
- Using one to sign in switches two-factor off, so you can set it up again on your new phone
- Wrong recovery codes count towards the lockout above, because redeeming a code removes your second factor
Notifications
Choose which emails you get. Everyone gets the essentials — payment receipts, confirmations and security notices — regardless of these settings. Session reminders, booking updates, new-message alerts and payout confirmations are all on by default, and leaving them on is wise: they are how you find out something needs you.Closing your account
Business owners: Account → Delete account. Advisors: Account → Leave the platform → Close account permanently. Either way it is permanent, either role can do it, and having past bookings no longer stops you. What changes is how much survives:
Financial and dispute records have to be kept — a legal obligation, not a preference. That is met by erasing you from them rather than by refusing to close your account.
Either way, the sign-in account goes so nobody can sign back in, your uploaded photo and documents are deleted, and you are emailed a confirmation.
Cannot reach your own account — locked out, lost the address, or just want to ask by email? Contact support and the team can close it for you, under exactly the same rules.
Your privacy in short
- Your challenge description is seen by you and the Whetstone team only. Never published, never shown to advisors at large.
- Your messages are between you and the other party. The team can read a thread when handling a problem on that booking, and every time they do it is logged — who looked, at what, and when. They can post in a thread too, always labelled as Whetstone, and always to both of you at once.
- Advisor ID and credential documents are private to the reviewing team. Clients only ever see the Verified badge.
- Card and bank details are held by Stripe, not Whetstone.
- Reviews you write are public on the advisor’s profile. The outcome survey is not.