Protect your sign-in

An authenticator app as a second step at sign-in, for your own account and, if a workspace chooses, for every one of its administrators, and a short account of how PadFlow itself is run.

Settings then Security is where an account adds an authenticator app. Once one is on the account, signing in asks for the six-digit code the app is showing after the password, and a password alone gets exactly as far as that prompt. This page is yours: what you add here changes your own sign-in and nobody else's.

Add an authenticator app

Press Add an authenticator app and PadFlow shows a QR code. Scan it with the app on your phone (Microsoft Authenticator, Google Authenticator, 1Password and the like all work; anything that speaks the ordinary time-based code standard does), then type the six digits the app shows to prove it holds the key. The key is shown once, on that screen, and PadFlow never stores it.

From the next sign-in on, whether by password or by Continue with Microsoft or Google, the code is asked for. A session that has not yet given one cannot open anything under the app, and that is checked on the server for every page and every action, not only by the sign-in form.

Remove one

Remove asks for the code the app is showing now, to prove the device is still in your hands, and then takes it off the account. With one app removed and none left, sign-in goes back to the password alone.

Recovery

There are no recovery codes. PadFlow does not issue them, and a second secret kept somewhere would be a second thing to lose. The spare is a second authenticator app on another device, added the same way. If every device is lost, ask PadFlow support to remove the authenticator from the account; the request is confirmed with you before anything is removed.

Require it of administrators

The second card is the workspace's. A workspace owner can turn on Administrators must have an authenticator app, and from the next page they open, every administrator of that workspace without one is sent to this page and nowhere else until they have added it. Everyone else may add one and nobody else is made to. It is off unless somebody turns it on.

Turning it on before adding your own means the next page you open is this one. The card says so beside the switch.

PadFlow's own support accounts are held to the same rule whatever a workspace chooses: the root console does not open for an account without an authenticator.

How PadFlow is run

Your sign-in is one part of a larger answer, and the rest of it is public. This is the short version of it. The security page is the long one, and it carries the list of every outside service that touches a workspace's data.

Where the data lives. One managed Postgres database, hosted in the United States, encrypted at rest. Every row carries the workspace it belongs to and row-level security in the database decides what a query may see, so a request signed in to one workspace cannot read or write another's rows even when the code above it asks. That refusal happens underneath the application rather than inside it.

Backups, and getting the data back. The database is on a plan with daily backups kept for a week, taken and restored by the provider's own tooling. Behind that is a second route that does not depend on their dashboard being available: the schema rebuilds from PadFlow's own migration history and the data loads from a dump file. Both halves have been rehearsed rather than assumed. A restore clears and loads inside one transaction that is committed only once every table holds the number of rows the dump says it should, so a restore that goes wrong leaves the target exactly as it found it.

Updates. A new version is built and started beside the one serving you and takes traffic only once it has answered for itself, so shipping an update does not drop a request. The FAQ has what that means while you are working.

What a model is told. Every read the assistant does goes through one gateway, and that gateway is restricted to providers whose terms forbid keeping the content or training on it. Every read is also booked against the workspace's own daily limit before it leaves, so there is a ceiling as well as a rule. Which reads happen at all is the workspace's decision and not ours: reading a file's cells out of email is one switch, sending a picture of a page to a model is a second switch, and the second is off until somebody turns it on. Both are on the settings page.

Second factor. Any account may add an authenticator app, a workspace owner may require one of every administrator, and PadFlow's own support accounts are held to that rule whatever a workspace chooses. The sections above are how.

Reaching us. [email protected]. The Help menu inside the app opens that message with the workspace, the screen and the build already filled in, which is most of what makes a report answerable.

What PadFlow does not have. There is no SOC 2 report. There is no published uptime figure either: nothing in the product measures one, and a number nobody measures is not worth reading.