Security & MFA
Every Koo account is protected by two-factor authentication from day one. This page covers how enrollment works, what to do if you lose access, how sessions are revoked, and how Koo protects your data.
Two-factor at signup
Phone verification is part of onboarding — it isn't optional, and there's no setting to turn it off. During signup you verify a phone number:
- Enter your phone number.
- Koo calls you with a verification code — or sends it by SMS if you prefer.
- Enter the code to finish enrollment.
Verification happens once, at signup. After that, a signed-in session is sufficient; you aren't re-prompted for a code on individual actions.
Recovery codes
When you finish phone verification, Koo generates a set of recovery codes. Each one can be used once to get into your account when you can't receive a call or SMS.
Recovery codes are shown once, at the moment they're generated. Store them somewhere safe — a password manager works well. You can regenerate the set at any time, but regenerating immediately invalidates every previous code.
If you lose both
If you lose your phone and your recovery codes, contact support. There is no self-service path by design: a support agent verifies your identity manually before resetting two-factor on your account.
Expect identity checks — details only the account holder would know, such as your account email, recent sign-in details, and billing history if you're on a paid plan. Once verified, support resets your enrollment and you verify a new phone number the next time you sign in.
This process deliberately takes time. Manual review is what keeps the recovery path from becoming a takeover path.
Sessions
Each browser or device you sign in on gets its own session. If you suspect one has been compromised, sign out everywhere: every active session is revoked at once, including the one you're using, and you sign in again on each device.
Signing out everywhere only affects your own sessions. When API tokens (kc_…) ship, they will belong to service accounts, not to you, and will be revoked individually rather than through sign-out.
One phone, one personal account
A phone number backs exactly one personal account. If a number is already verified on a personal account, it can't be used to sign up for another.
Team accounts are separate: people who administer a shared account can use the same phone number they verified on their own personal account. See Teams & roles for how shared accounts work.
How Koo protects your data
- Every variable is encrypted at rest and decrypted only to run your services. Mark a variable sensitive to withhold its value from ordinary reads — seeing it then takes an explicit reveal, and every reveal is recorded in the audit trail.
- Sensitive operations on your account — member changes, deletions, plan changes — are recorded in an append-only audit trail.
- Each account runs in its own isolated tenant on Koo's hosting layer; nothing is shared between accounts.