# Security & MFA

Every Koo account is protected by two-factor authentication from day one. This page covers how enrollment works, what to do if you lose access, how sessions are revoked, and how Koo protects your data.

## Two-factor at signup

Phone verification is part of onboarding — it isn't optional, and there's no setting to turn it off. During signup you verify a phone number:

1. 
2. 
3.

Verification happens once, at signup. After that, a signed-in session is sufficient; you aren't re-prompted for a code on individual actions.

## Recovery codes

When you finish phone verification, Koo generates a set of recovery codes. Each one can be used once to get into your account when you can't receive a call or SMS.

> **Warning:**
>
> Recovery codes are shown once, at the moment they're generated. Store them somewhere safe — a password manager works well. You can regenerate the set at any time, but regenerating immediately invalidates every previous code.

## If you lose both

If you lose your phone **and** your recovery codes, contact [support](https://koo.io/support). There is no self-service path by design: a support agent verifies your identity manually before resetting two-factor on your account.

Expect identity checks — details only the account holder would know, such as your account email, recent sign-in details, and billing history if you're on a paid plan. Once verified, support resets your enrollment and you verify a new phone number the next time you sign in.

This process deliberately takes time. Manual review is what keeps the recovery path from becoming a takeover path.

## Sessions

Each browser or device you sign in on gets its own session. If you suspect one has been compromised, sign out everywhere: every active session is revoked at once, including the one you're using, and you sign in again on each device.

Signing out everywhere only affects your own sessions. When [API tokens](/docs/developers/api-tokens) (`kc_…`) ship, they will belong to service accounts, not to you, and will be revoked individually rather than through sign-out.

## One phone, one personal account

A phone number backs exactly one personal account. If a number is already verified on a personal account, it can't be used to sign up for another.

Team accounts are separate: people who administer a shared account can use the same phone number they verified on their own personal account. See [Teams & roles](/docs/collaboration/teams-and-roles) for how shared accounts work.

## How Koo protects your data

- 
- 
-