# Security & MFA

Every Koo account is protected by two-factor authentication from day one. This page covers how enrollment works, what to do if you lose access, how sessions are revoked, and how Koo protects your data.

## Two-factor at signup

Phone verification is part of onboarding — it isn't optional, and there's no setting to turn it off. During signup you verify a phone number:

1. 
2. 
3.

Verification happens once, at signup. After that, a signed-in session is sufficient; you aren't re-prompted for a code on individual actions.

## Recovery codes

When you finish phone verification, Koo generates a set of recovery codes. Treat them as a backup credential and store them safely — today there is no sign-in step that asks for one, so if you lose access to your phone, the support path below is the way back in.

> **Warning:**
>
> Recovery codes are shown once, at the moment they're generated. Store them somewhere safe — a password manager works well. You can regenerate the set at any time, but regenerating immediately invalidates every previous code.

## If you lose both

If you lose your phone **and** your recovery codes, contact [support](https://koo.io/support). There is no self-service path by design: a support agent verifies your identity manually before resetting two-factor on your account.

Expect identity checks — details only the account holder would know, such as your account email, recent sign-in details, and billing history if you're on a paid plan. Once verified, support resets your enrollment and you verify a new phone number the next time you sign in.

This process deliberately takes time. Manual review is what keeps the recovery path from becoming a takeover path.

## Sessions

Each browser or device you sign in on gets its own session. **Sign out** in the console ends the session in that browser only — there is no control yet that revokes every session at once. If you suspect a session has been compromised, contact support.

Sign-out only affects your own sessions. [API tokens](/docs/developers/api-tokens) (`kc_…`) belong to service accounts, not to you, and are revoked individually rather than through sign-out.

## One phone, one personal account

A phone number backs exactly one personal account. If a number is already verified on a personal account, it can't be used to sign up for another.

Team accounts are separate: people who administer a shared account can use the same phone number they verified on their own personal account. See [Teams & roles](/docs/collaboration/teams-and-roles) for how shared accounts work.

## How Koo protects your data

- 
- 
-