Security & MFA
Every Koo account is protected by two-factor authentication from day one. This page covers how enrollment works, what to do if you lose access, how sessions are revoked, and how Koo protects your data.
Two-factor at signup
Phone verification is part of onboarding — it isn't optional, and there's no setting to turn it off. During signup you verify a phone number:
- Enter your phone number.
- Koo calls you with a verification code.
- Enter the code to finish enrollment.
Verification happens once, at signup. After that, a signed-in session is sufficient; you aren't re-prompted for a code on individual actions.
Recovery codes
When you finish phone verification, Koo generates a set of recovery codes. Treat them as a backup credential and store them safely — today there is no sign-in step that asks for one, so if you lose access to your phone, the support path below is the way back in.
Recovery codes are shown once, at the moment they're generated. Store them somewhere safe — a password manager works well. You can regenerate the set at any time, but regenerating immediately invalidates every previous code.
If you lose both
If you lose your phone and your recovery codes, contact support. There is no self-service path by design: a support agent verifies your identity manually before resetting two-factor on your account.
Expect identity checks — details only the account holder would know, such as your account email, recent sign-in details, and billing history if you're on a paid plan. Once verified, support resets your enrollment and you verify a new phone number the next time you sign in.
This process deliberately takes time. Manual review is what keeps the recovery path from becoming a takeover path.
Sessions
Each browser or device you sign in on gets its own session. Sign out in the console ends the session in that browser only — there is no control yet that revokes every session at once. If you suspect a session has been compromised, contact support.
Sign-out only affects your own sessions. API tokens (kc_…) belong to service accounts, not to you, and are revoked individually rather than through sign-out.
One phone, one personal account
A phone number backs exactly one personal account. If a number is already verified on a personal account, it can't be used to sign up for another.
Team accounts are separate: people who administer a shared account can use the same phone number they verified on their own personal account. See Teams & roles for how shared accounts work.
How Koo protects your data
- Every variable is encrypted at rest and decrypted only to run your services. Mark a variable sensitive to withhold its value from ordinary reads — seeing it then takes an explicit reveal, and every reveal is recorded in the audit log.
- Sensitive operations on your account — member changes, deletions, plan changes — are recorded in an append-only audit trail.
- Each account runs in its own isolated tenant on Koo's hosting layer; nothing is shared between accounts.