Guide

Security, 2FA & sessions

Your account holds your company's brain, so it is defended like one: encryption at rest, two-factor auth, session control, and rate-limited, audited access.

← All guides

Account protection

Passwords are stored as strong one-way hashes. API keys, integration tokens, saved logins, and memory notes are AES-encrypted at rest. All traffic is TLS. Sign-in attempts are rate-limited and security-relevant events are audited.

Two-factor authentication

  1. Open Profile → Security and enable two-factor authentication.
  2. Scan the QR code with any authenticator app (or enter the secret manually) and confirm with a code.
  3. Store the one-time backup codes somewhere safe - each unlocks your account once if you lose the device.
  4. From then on, sign-in asks for your password plus a 6-digit code.

Sessions

Profile → MORE lists every device signed into your account with when it was last seen. Revoke any session and that device is signed out immediately.

OAuth sign-in

If you signed up with Google, GitHub, or LinkedIn, authentication is delegated to that provider - Magnus never sees a password. You can use email+password and OAuth side by side on the same account.