Account security
- Email verification is required before an account is treated as active.
- Password sign-in is complemented by optional time-based two-factor authentication with backup codes.
- Security alerts are raised in-app for sensitive account changes.
