From e1b77e3b1342716e206009142c43e4e777be7c4d Mon Sep 17 00:00:00 2001
From: thomchambers <thomas.chambers@digital.cabinet-office.gov.uk>
Date: Wed, 28 Feb 2018 15:33:47 +0000
Subject: [PATCH 1/2] Update Security page content

Adding some new content based on feedback from user research.
---
 app/templates/views/security.html | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/app/templates/views/security.html b/app/templates/views/security.html
index 25a15226c..38320c51a 100644
--- a/app/templates/views/security.html
+++ b/app/templates/views/security.html
@@ -44,9 +44,20 @@
       <li>protective monitoring to record activity, and raise alerts about any suspicious activity</li>
       <li>using JSON Web Tokens, to avoid sending API keys when your service talks to Notify</li>
     </ul>
-
-    <h2 class="heading-medium">User permissions</h2>
+    
+    <h3 class="heading-small">Protect sensitive information</h3>
+    <p>Some messages include sensitive information like security codes or password reset links.</p>
+    <p>If you’re sending a message with sensitive information, you can choose to hide those details on the Notify dashboard once the message has been sent. This means that only the message recipient will be able to see that information.</p>
+    
+    <h2 class="heading-medium">User permissions and signing in</h2>
     <p>You can set different user permissions in Notify. This lets you control who in your team has access to certain parts of the service.</p>
+    <h3 class="heading-small">Two-factor authentication</h3>
+    <p>To sign in to Notify, you’ll need to enter:</p>
+    <ul class="list list-bullet">
+      <li>your email and password</li>
+      <li>a text message code that Notify sends to your phone</li>
+    </ul>
+    <p>If receiving text messages at work is a problem for your team, <a href="https://www.notifications.service.gov.uk/">contact us</a> about using an email link instead.</p>
 
     <h2 class="heading-medium">Information risk management</h2>
     <p>Our approach to information risk management follows National Cyber Security Centre (NCSC) guidance. It assesses:</p>

From e899e2e8261702250ae6b682e7b97c21aff6c694 Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Wed, 28 Feb 2018 16:05:16 +0000
Subject: [PATCH 2/2] Make it clearer what you sign in using with
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid confusion between and email you’re sent and an email address that is your username.
---
 app/templates/views/security.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/templates/views/security.html b/app/templates/views/security.html
index 38320c51a..49b133b43 100644
--- a/app/templates/views/security.html
+++ b/app/templates/views/security.html
@@ -54,7 +54,7 @@
     <h3 class="heading-small">Two-factor authentication</h3>
     <p>To sign in to Notify, you’ll need to enter:</p>
     <ul class="list list-bullet">
-      <li>your email and password</li>
+      <li>your email address and password</li>
       <li>a text message code that Notify sends to your phone</li>
     </ul>
     <p>If receiving text messages at work is a problem for your team, <a href="https://www.notifications.service.gov.uk/">contact us</a> about using an email link instead.</p>