How-to1 min read·Updated Nov 2, 2026
Security: two-factor authentication and sessions
Protect accounts with 2FA, review active sessions and enforce policies for the whole team.
Requires permission
agency.settings.edit- Personal 2FA: Profile → Security → Enable 2FA; scan the QR with any authenticator app and store the recovery codes.
- Require 2FA for the team: Settings → Security → toggle. Users without 2FA are asked to set it up at next login.
- Sessions: Profile → Security lists devices and locations; sign out any of them. Managers can sign a user out everywhere from Settings → Team.
- Policies: minimum password length, session lifetime, and allowed email domains for invitations.
Client and owner portal accounts use their own password or WhatsApp magic-link; the policies above apply to staff accounts.
Was this article helpful?