Nothing to steal

No password database, no credential stuffing. A code lives 10 minutes, then dies.

2FA when it matters

Optional TOTP per workspace — required for admins and Agency plans.

Rate-limited and audited

3 attempts, a 15-minute lockout, every sign-in recorded in the workspace audit log.