Second factor and step-up

• Methods. An authenticator app (TOTP) or a security key. There are no SMS codes.
• Policy. An organization can require a second factor of every member, and new organizations start with it required. Administrators see who is enrolled, and can reset a member's factor; the reset is audited.
• Step-up. Sensitive actions ask for a fresh second factor, among them creating API keys, lowering data retention and exporting personal data.