> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vistazo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Sign-in methods, two-factor, authorized apps, and closing an account.

Everything here lives under **Settings → Security**.

## Ways to sign in

| Method              |                                                                |
| ------------------- | -------------------------------------------------------------- |
| Google or Microsoft | Continue with an existing account                              |
| Password            | How a new account is created with an email address             |
| Email code          | A one-time code, for signing in to an account you already have |
| Passkey             | Face, fingerprint or device PIN, once you have added one       |
| Single sign-on      | For Enterprise workspaces, through your own identity provider  |

Creating an account by email means setting a password. Codes and passkeys are ways back into an account
that already exists, not ways to make one.

Email is a credential rather than an identity, so changing your address does not change who you are. An
address change can be reverted from a link sent to the old one.

The cards split by what they hold. **Identity** carries your email and your Google and Microsoft links.
**Sign-in** carries your password, passkeys and two-factor.

## Passkeys

Add one per device, and rename them so a list of four stays legible. A passkey is the strongest option
here and the least work at sign-in.

## Two-factor authentication

Vistazo has its own time-based one-time password second factor, so any authenticator app works. Enabling
it issues **recovery codes**; store them somewhere that is not the phone with the authenticator on it.

Once enabled, the factor gates more than sign-in. Sensitive actions re-prove it at the moment you take
them, rather than trusting that you proved something when the session began. Turning two-factor off
requires a live code, so a hijacked session cannot quietly remove it.

<Warning>
  If you lose both the authenticator and the recovery codes, recovery runs through Vistazo support.

  Workspace admins can reset the factor only for members their directory manages, which means an
  Enterprise workspace with directory provisioning turned on. On a personal account, or a Team workspace
  without it, no administrator can do this for you. Keep the recovery codes.
</Warning>

## Authorized apps

Every MCP client you have connected to Vistazo appears here, with when it was last used, and a Revoke
button.

Revoking takes effect within about a minute. Access tokens are short-lived and cannot be recalled
individually, so the server re-checks the grant behind a brief cache rather than waiting for the token to
expire. See [Connect an agent](/mcp/connect#consent-and-scope).

## Downloading your data

**Settings → Security → Account** can build an export of your data: a zip containing a browsable copy
plus the underlying JSON, and a CSV for each widget that has rows. Files come down as separate parts, so
a large account does not depend on one enormous download.

The export covers what closing your account would destroy on your behalf. Content owned by workspaces you
merely belong to is not yours to export.

## Closing your account

Deleting re-proves your identity first, and is then reversible for **30 days**. During that window the
account is suspended, and signing in reaches a restore screen and nothing else. After it, the purge runs
and the data is gone.

Export first if you want a copy. An export cannot be built once the account is suspended.