Account & security
These three tabs cover your personal account, its security, and a record of what's happened in the workspace.
On this page
Account
Two cards: Profile (display name, email) and Change password.
Change password
Current password
New password
Password rules shown at submit time: a current password is required, the new password must be at least 8 characters, and confirmation must match.
Neither card currently persists a change. Both show a normal confirmation ("Profile saved." / "Password updated.") after submitting, but there's no account record behind either field yet — a new display name, a changed email, or a new password won't actually be saved or take effect. There's no avatar upload and no account-deletion option here either; the only deletion control anywhere in the app is workspace deletion in Danger Zone, which is itself not implemented yet.
Security
The Security tab is entirely about two-factor authentication (2FA) — a real, working feature, unlike the Account tab above.
Authenticator app not enabled
Add a verification step before workspace access is granted.
Clicking Enable 2FA shows a QR code to scan with an authenticator app, plus a field to confirm setup with the resulting 6-digit code.
Authenticator code
Once confirmed, a one-time screen shows your backup codes with the warning "Save these backup codes now. They will not be shown again." — a Copy codes button and a Done button close it out. From then on, the tab shows "Authenticator app enabled" with a green ENABLED badge and your remaining backup-code count, and disabling it requires entering a current authenticator code, not your password.
This is the same 2FA that gates login — an account with it enabled is asked for a code at /login/2fa after a normal password sign-in, as covered in Introduction. There's no "active sessions" or "sign out other devices" control anywhere in Settings — 2FA is the only account-security control that exists today.
Audit Log
A workspace-scoped, paginated log of real actions — steps saved, campaigns started or paused, inboxes connected or disconnected, contacts imported, and more.
Each row shows a colored Create/Update/Delete pill next to the plain-language action, who did it, what it was done to, and when — 25 rows per page, filterable by a date range. With nothing logged yet, it shows "No activity recorded yet — Actions taken in your workspace will appear here."
Workspace renames aren't logged here, and there's no team-member invite or role-management feature anywhere in the app today — so there's nothing to log for membership changes either. What you will see is real activity from Campaigns, Inboxes, Lists, Lead Finder, and Reply Box.
Where to go next
Next: Workspace & billing