# Security

> Protect your account with multi-factor authentication, active session management, and the password policy.

*[View this page in the Flax docs](https://flax-analytics.com/docs/administration/security)*

Flax gives you personal account-security controls under `/app/settings/security`: multi-factor authentication, session management, and a password policy. These apply to your own account; org-wide sign-in is covered in [SSO](/docs/administration/sso).

## Multi-factor authentication (MFA)

MFA adds a time-based one-time password (TOTP) from an authenticator app on top of your password.

1. Start enrollment and scan the QR code into your authenticator app.
2. Confirm with a code from the app to activate MFA.
3. Store the **recovery codes** shown on confirmation — they are displayed only once and let you sign in if you lose your device.

At sign-in you enter a code from your app, or a recovery code. You can disable MFA from security settings.

## Sessions

Every active sign-in is a session. From security settings you can:

- **List active sessions** to see where you are signed in.
- **Revoke a single session** to sign out one device.
- **Sign out everywhere** to end all sessions at once — useful after losing a device.

## Password policy

Passwords must be between **12 and 512 characters**. There are no forced composition rules such as mixed case or symbols; length is the requirement. You can change your password from security settings, and reset a forgotten one via the email reset flow.

> [!TIP]
> A long passphrase plus MFA is the strongest combination. Turn on MFA even if your organization also uses SSO, for any account that still signs in with a password.

## Related

- [SSO](/docs/administration/sso)
- [Audit log](/docs/administration/audit-log)
- [Privacy and GDPR](/docs/administration/privacy-gdpr)