Account security

• Turn on two-factor authentication in Settings → Two-factor authentication: scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password…), confirm the 6-digit code, and you’ll be asked for a fresh code at every sign-in.
• It means a stolen or guessed password alone can’t get into your account or your clients’ data — you can turn it off again any time from the same place.
• Keep a backup of your authenticator app (most offer cloud backup) so a new phone doesn’t lock you out, and always use a strong, unique password.
• When you set a password, we check it against public breach databases (privacy-preserving — only an anonymised fragment leaves your browser) and ask you to choose another if it’s a known-breached one.