Account security, 2FA and your data

Two-factor authentication (2FA)

2FA is available on every plan, including the trial, and takes a minute to set up:

1. Open Settings and find the two-factor section.
2. Scan the code with an authenticator app (any standard TOTP app works).
3. Enter the current code to confirm.
4. Save the backup codes somewhere safe. Each works once, and they are the only way back in if you lose the authenticator.

Passwords and resets

• Password resets use a single-use link that expires after one hour. Asking for a new link invalidates the old one.
• Registration itself requires confirming your email address within one hour before the account is created.

Team access

• Invite members from the Team page; your plan sets the number of seats.
• Members act inside your account, so only invite people you trust with your codes and analytics.
• Remove a member the day they leave. Their access ends immediately; the codes and data stay with the account.

Export and deletion (GDPR)

• Export: from Settings, Privacy and data, download a full export of your account data. Secrets (passwords, API keys, signing secrets) are never included in an export.
• Delete: account deletion is owner-only and asks for your password and the account name typed in full, as deliberate friction. It is blocked while a Paddle subscription is active; cancel first.
• The Privacy and data settings also include an IP anonymisation toggle for scan data.