If you have lost your password and cannot sign in, the recovery flow is built into the login page. It is short and stays out of your way once you have a new password.
Where to start
/login → Forgot your password? link. Or go directly to /forgot-password.
What you see
A short form with one field — your email address — and a submit button. Submit and the form replaces itself with a confirmation message: If an account exists for that email, a reset link has been sent. Check your inbox.
The deliberately vague phrasing — if an account exists — is intentional. It avoids confirming or denying whether an email is registered, which prevents the form from being abused to enumerate active accounts.
What lands in your inbox
An email titled Reset your Jadiroon password. The body has:
- A short instruction line.
- A button labelled Set a new password linking to
/reset-password?token=.... - A plain-text fallback URL underneath, in case the button does not render.
The token is valid for one hour. After that, you need to start the recovery again.
Setting your new password
Click the link. The reset page asks for:
- New password (8+ characters).
- Confirm new password.
Submit. The platform validates that the two match and that the new password meets the minimum length, updates your password, and signs you in. Other devices where you were previously logged in are signed out.
What if the email never arrives
Three things to check:
- Your spam and quarantine folders. Some corporate filters route automated mail aggressively.
- The address you used. Make sure it matches your account email exactly.
- The rate limit. The forgot-password endpoint allows three requests per hour per email address. If you have requested several already in a short period, wait an hour and try again.
If after these checks the email still does not arrive, write to hello@jadiroon.sa with the email address you are trying to recover. We can verify whether the account exists and, if so, issue a reset manually.
What if the link is expired
If you click the link more than an hour after it was issued, the reset page shows an Expired link message and a button to start the recovery again. The token is single-use and time-bounded; you cannot reuse it once it has expired.
What recovery does not do
- It does not reveal your old password. Passwords are hashed; nobody at Jadiroon can read or recover them. The only path is to set a new one.
- It does not change your email or any other profile detail. Recovery is strictly about the password.
- It does not signal anyone in your workspace. A password reset is a private action. Your line manager and HR are not notified.
Account lockout
The platform does not lock accounts on failed sign-in attempts in v0.5. There is rate-limiting on the failed-attempt path to slow down brute force, but no count-then-lock policy. If you suspect your account is being targeted, write to hello@jadiroon.sa with details.
Next
Section VII — Workspace administration returns to the HR-administrator perspective for the operational settings that keep a workspace healthy.