Account security — 2FA & step-up

Coalface’s philosophy is privacy built in, security opt-in — your content is protected by default, and you turn on the extra account controls you want. This page covers two-factor authentication and step-up checks.

Two-factor authentication (2FA)

Add a second step to your login with an authenticator app (the standard TOTP six-digit codes).

To turn it on, go to Settings → Personal → Two-factor authentication:

1. Start enrolment — you’ll get a QR code (and a manual key).
2. Scan it with your authenticator app.
3. Enter the six-digit code it shows to confirm.

From then on, logging in asks for a fresh code after your password. To turn 2FA off, remove the factor from the same screen.

Step-up checks

Some actions are sensitive enough that Coalface can ask you to re-confirm who you are right before you do them — even though you’re already logged in. This “step-up” check protects things like:

• Revealing a Vault value
• Deleting data
• Inviting an admin

When one of these comes up, you’ll see a quick confirmation prompt. You can mark a device as trusted so you’re not asked again on your own machine for a while.

What pairs well with this

• Encryption & the Vault — protect the content; account security protects access to it.
• Roles — give each member the least they need (see inviting people); the strongest login in the world can’t beat over-broad permissions.

The short version: turn on 2FA in Settings → Personal for a second login step, and rely on step-up checks to re-confirm you before the most sensitive actions. Trust your own device to keep it smooth.