Privacy and security

Role-based access, encrypted storage, and no permanent public URLs.

• Every user sees only what their role permits — no exceptions.
• Documents are stored in a private object store, never on a public URL.
• Downloads use short-lived signed links that expire automatically.
• All sensitive values (credentials, tokens) are encrypted at rest.
• Every action is logged for audit with actor, timestamp, and resource.

Enable TOTP-based MFA for your account.

• Go to Profile → Security to enable two-factor authentication.
• Scan the QR code with your authenticator app (Google Authenticator, Authy, etc.).
• Enter the 6-digit code to confirm enrolment.

Extra authentication for approvals and role changes.

• Sensitive actions (refund approvals, role changes) require re-authentication.
• You will be prompted for your authenticator code before the action completes.
• This protects against stolen sessions being used for high-value operations.