Key takeaways
- Administrators can add a second sign-in step with any authenticator app.
- Five failed sign-in attempts lock an account for 15 minutes.
- Passwords are hashed with Argon2 and never stored in a readable form.
Monitoring software holds attendance and activity data about your whole team, which makes administrator accounts the obvious target. Security here is two things: protecting the accounts, and collecting little enough that there is less to lose.
Two-factor sign-in
Each administrator can add a 6-digit code from any authenticator app, such as Google Authenticator, 1Password or Authy, from the Security page. A stolen password alone is then no longer enough, and turning two-factor off requires both the password and a code. It is strongly recommended for administrators.
Passwords and sessions
Passwords are hashed with Argon2 and are never stored in a readable form.
Five failed sign-in attempts lock an account for 15 minutes.
Sessions use short-lived access tokens with rotating refresh tokens, and reusing an old refresh token revokes the session.
Password reset links are single-use and expire after 1 hour.
Separation and minimal collection
Every request is scoped to your organization, so your data stays separate from every other customer's. The agent never records keystroke content or takes screenshots, and you choose how long activity data is kept, with older data deleted automatically.
Read the security and privacy overview and the privacy policy.