Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
Everything you own, in one click. The JSON export covers every table, with password hashes, two-factor secrets, signing secrets and webhook URLs left out; after restoring it on a fresh install, re-enter your webhook URLs, as you do signing secrets; the database file is the rawest possible backup on SQLite installs. Both carry table rows only: the receipt files download as their own archive — extract it into data/uploads/receipts/ beside a restored database. Administrators only.
Download full backup (JSON) Download database file (SQLite) Download receipt files (.tar)