Security and your data

Under Settings → Security you can register an authenticator app (1Password, Authy, Google Authenticator, or similar) as a second factor, using a scanned or pasted setup key. It's strongly recommended for any account that holds tenant or financial data.

Some actions always ask for it: changing your autonomy limits, setting or clearing the emergency stop, and downloading your data require two-factor sign-in. Other sign-ins don't yet demand a second factor every time, so keep a strong, unique password as well.

Once you have a verified factor, generate single-use backup codes and store them somewhere safe (a password manager) — they're your way back in if you lose your authenticator. You can download or copy them, and regenerating invalidates any old unused codes.

The Security screen also lets you sign out of every device at once (useful if a device is lost or stolen) and shows a login history of recent activity with browser, OS, and IP. If anything looks unfamiliar, change your password and confirm 2FA is on.

Under Settings → Account, "Your data" downloads a JSON export of records tied to your own sign-in, such as your profile. It requires two-factor sign-in, and it lists document details rather than including every stored file.

Settings → Audit log lists recorded changes in your workspace, such as changes to your limits, with what changed, when, and who made the change. Aptoria doesn't carry out routine work on its own yet, so there are no autonomous actions in it; undo for autonomous actions is planned.