Overview
Account security lives under Dashboard → Settings → Security. Enable MFA for stronger sign-in protection, revoke sessions, and use the public password-reset flow if you lose access to your password.
- Email verification is required for new accounts
- MFA can be enabled or disabled from Security settings
- Password reset sends a one-time link or code to your email
- Email and password, with optional MFA
How your data is protected
- Two-step sign-in with an authenticator app, recovery codes stored only as hashes, and a fresh check before sensitive changes
- Channel tokens and AI keys are stored encrypted
- The audit log and security events are protected in the database: entries cannot be deleted, and the only changes allowed are GDPR redaction and a delivery timestamp
- A strict Content Security Policy is enforced on the dashboard and the website
- Single sign-on (OIDC) and an IP allowlist on the Business plan
- Your data is hosted by Hetzner in Finland, inside the European Economic Area
The Privacy Policy and the Security page describe our subprocessors and how personal data is handled.
Was this article helpful?
Your feedback helps us improve our documentation.