# Account, two-factor and roles

> Turning on two-factor, recovery codes, re-verification for sensitive actions, workspace roles and invitations.

Belvador controls infrastructure in your Hetzner account and holds metadata about your apps, so account security is strict by design: two-factor authentication is required for anything sensitive, and the most sensitive actions ask for a fresh code.

## Sign in

- **Create your account** with your name, email and a password, then confirm your email. If an account already exists for that email, the screen looks the same — Belvador never reveals who has an account.
- **Sign in to Belvador** with email and password, then your 6-digit code if two-factor is on.
- Forgot your password? Choose **Forgot password?** on the sign-in page; Belvador emails a reset link that works once and expires after an hour.

## Two-factor authentication

Turn it on in **Account → Account security**, or during workspace setup.

1. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy…) or type the secret shown.
2. Enter the 6-digit code to confirm.
3. Save your **Recovery codes**. There are 10, each works **once**, and they are shown only at this moment. Store them in a password manager or print them.

You need two-factor before you can connect Hetzner, invite people or change roles.

### Lost your phone?

On the code screen choose **Lost your device? Use a recovery code** and enter one of your saved codes. Each code works once — afterwards, set up your authenticator again in Account security and create new recovery codes.

If you have lost both your authenticator and your recovery codes, email hello@belvador.dev from your account's address.

## Re-verification for sensitive actions

Some actions ask **Confirm it's you**: enter a current code from your authenticator. A code verified in the last 10 minutes counts, so a series of changes asks only once. This means a stolen session alone cannot change infrastructure or access.

Actions that ask for it:

- connecting Hetzner and choosing token custody;
- creating or revoking DSN keys and upload tokens;
- inviting members and changing roles;
- changing your email or password, regenerating recovery codes, turning off two-factor;
- turning on support access;
- adding, editing or deleting alert destinations;
- replacing a machine, deleting a node, changing the backup key holder, uploading a recovery kit;
- deleting a project or a workspace.

If two-factor is not set up yet, Belvador asks you to **Set up two-factor** first.

## Sessions

**Account security → Sessions** lists where you are signed in. **Sign out of all other devices** ends every session except this one. The page also shows your personal security history.

## Workspace roles

Each member of a workspace has one role. Higher roles can do everything lower roles can.

| Role | Can |
|---|---|
| **Viewer** | See projects, issues, Fleet, the node and alerts |
| **Member** | Also triage issues (resolve, archive, assign, priority) and create and manage projects |
| **Admin** | Also manage alerts, members, the Hetzner connection, the node, project limits and data protection, workspace settings and support access |
| **Owner** | Also delete the node or workspace, choose Strict token custody and the backup key holder, and promote others to owner |

A workspace always has at least one owner.

## Audit log

Security-relevant actions — sign-ins from a new device, two-factor changes, role changes, invitations, DSN keys and upload tokens, alert destinations, the Hetzner connection, node operations, support access and deletions — are written to an append-only audit log. Each entry is chained to the previous one by its hash and the chain is anchored outside the database every day, so an entry cannot be changed or removed without it showing. Entries hold who, what, when and the object, never secret values or error contents.

You see your own entries under **Account security → Sessions**; owners see each support access under **Settings → Support access**. There is no workspace-wide audit log page yet.

## Invite your team

1. Open **Settings → Members → Invite**.
2. Enter their email and a role: **Admin**, **Member** or **Viewer**. (Owners are made by promoting a member.)
3. **Create invitation** — confirm with your code.

Belvador emails the invitation, or — if email delivery is not set up — shows a link to send yourself. **This link is shown only once.** It expires in 7 days. Pending invitations are listed with their expiry and can be revoked.

## Support access

Belvador staff cannot read your errors, events, traces or logs — they live on your node, and no staff role can get a ticket to it. Staff see account metadata only: workspace and project names, versions, counts and health.

**Settings → Support access** is off by default. When an admin turns it on (with a code), Belvador support can also see this workspace's configuration — monitors, uptime checks, alert rules and project settings — to help you faster. Secret values (tokens, webhook URLs, chat IDs, passwords) are never shown to staff. Sessions from the earlier read-only support view, if any, stay listed under **Earlier support sessions**.

## Delete a workspace

Owners can **Delete workspace** in **Settings**: type the workspace address and confirm with a code. Deletion runs 24 hours after you confirm and can be cancelled until then.