As an IT Professional, I strongly agree that two-factor authentication (2FA) is non‑negotiable (rolling‑code one‑time passwords and FIDO2‑compliant hardware security keys). In addition, every secure platform should implement these core account protection controls:

1) Real‑time email or push notifications whenever a new login or access to the account occurs.​

2) A detailed session management dashboard displaying all active devices and browser sessions, with the ability to remotely terminate any connection instantly.​

3) Strong password policy with checks against known breached password lists and support for secure single sign-on (SSO) via standards such as SAML or OIDC with trusted identity providers.​

4) Adaptive, risk‑based authentication that triggers step‑up verification for high‑risk signals such as new devices, unusual geolocation, TOR/VPN usage, or impossible travel patterns.​

5) Account lockout thresholds, cooldown periods, and CAPTCHA challenges after repeated failed login attempts to slow and deter brute‑force attacks

Yes, please 2FA must be required to login, change password, and delete account.

Hey Savion, pop us an email at [email protected] and we can switch it for you!

What security is used with Recall?

I personally use Microsoft Authenticator so if that gets supported, it would be awesome :)

Merged this one into the one below. Please close out this one.

Merging this one here.

Two factor authentication