Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
The JSON export is the shareable one — passwords, 2FA secrets, API-key hashes, payment-webhook secrets and SMTP credentials are all redacted, so handing it to a bookkeeper hands over no keys. The database file is the whole store, credentials included — that one stays private.
Download full backup (JSON) Download database file (SQLite) Restore…