Enabling email OTP 2FA, what it protects, and security architecture notes.
4 min read
Enabling 2FA
Go to Profile → Security.
Toggle Two-factor authentication.
From now on, every login requires a one-time code sent to your email. Codes expire quickly and are invalidated after use; repeated wrong attempts lock the code.
What else protects your account
Row-level security - every contact, list and campaign is scoped to its owner. No user (or API key) can touch another user's data.
Audit logging - sensitive admin actions are recorded and visible to admins under Logs.
API keys are hashed - stored only as irreversible hashes with a short visible prefix.
Human-in-the-loop sending - no email leaves the system without an explicit confirmation click.
Recommendations
Enable 2FA for every team member (admins can see who has it on).
Create one API key per external system, never share keys between tools.
Remove team members immediately when they leave - their access ends instantly.