Security

Protect your account with multi-factor authentication, active session management, and the password policy.

Flax gives you personal account-security controls under /app/settings/security: multi-factor authentication, session management, and a password policy. These apply to your own account; org-wide sign-in is covered in SSO.

#Multi-factor authentication (MFA)

MFA adds a time-based one-time password (TOTP) from an authenticator app on top of your password.

1. Start enrollment and scan the QR code into your authenticator app.
2. Confirm with a code from the app to activate MFA.
3. Store the recovery codes shown on confirmation — they are displayed only once and let you sign in if you lose your device.

At sign-in you enter a code from your app, or a recovery code. You can disable MFA from security settings.

#Sessions

Every active sign-in is a session. From security settings you can:

• List active sessions to see where you are signed in.
• Revoke a single session to sign out one device.
• Sign out everywhere to end all sessions at once — useful after losing a device.

#Password policy

Passwords must be between 12 and 512 characters. There are no forced composition rules such as mixed case or symbols; length is the requirement. You can change your password from security settings, and reset a forgotten one via the email reset flow.

#Related

• SSO
• Audit log
• Privacy and GDPR