CRM two factor authentication
Enroll in one minute with any authenticator app (Google Authenticator, 1Password, Authy). Required for admin and owner roles, optional for managers, enforced at the session level.
Live in 5 minutes · No setup fee · No long-term contract
When client data is one password away
A service business CRM holds client addresses, phone numbers, payment info, and call transcripts. A single password away from a data breach is not the right posture.
Passwords Leak
Between credential-stuffing attacks and phishing, password-only auth fails predictably. One reused password in a breach dump and the attacker is in.
No SMS Fallback Problem
SMS 2FA gets phished and SIM-swapped. TOTP codes from an authenticator app are the proven-safe standard for business apps.
Compliance Expectations
Insurance carriers, enterprise clients, and some state contracts require 2FA on any system holding customer data. Password-only is a non-starter.
How TOTP enrollment plugs in
Enroll With a QR Code
From settings, click Enable 2FA. Scan the QR with your authenticator app. Enter the first 6-digit code to confirm enrollment.
Log In With a Code
On every new login, enter email and password, then the 6-digit code from the app. Supabase handles AAL2 session upgrade automatically.
Middleware Enforces
Protected routes require AAL2. Sessions without 2FA completion are redirected to the verify page until the code is entered.
Recover if Needed
Lost your device? Admins can reset 2FA on any org user. Owners can reset their own via the password-reset flow with email confirmation.
What 2FA covers
TOTP via Any App
Works with Google Authenticator, 1Password, Authy, Microsoft Authenticator, and any RFC 6238 TOTP app. No proprietary vendor lock-in.
AAL2 Session Enforcement
Middleware checks Assurance Level 2 on every protected route. Session elevation happens on successful 6-digit code entry.
Role-Gated Requirement
Admin role requires 2FA. Owner is strongly recommended. Managers and affiliates optional. Clients and techs exempt by default.
QR Code Enrollment
One-minute setup: scan, verify, done. No typing of secret keys, no paper backup codes to print.
Admin Reset
Org admins can reset 2FA on any team member if a device is lost. Reset events are logged in the audit trail.
Supabase Auth Integration
Uses Supabase's native MFA implementation so your auth stack stays consistent, no third-party identity provider required.
Trades holding data worth stealing
The service businesses that get the most out of this feature, and the specific way each one uses it.
Login with TOTP
2FA adoption across Smarfle service businesses.
Owners with 2FA
Admins Enrolled
Blocked Logins (30d)
Owner enrollment
84% of owners have 2FA on
Team enrollment
62% of managers opted in
Breach prevention
47 failed logins blocked by 2FA
Security questions
What if I lose my phone?
Is SMS 2FA supported?
Do clients need 2FA?
Does 2FA affect API keys?
What two factor costs
2FA Is Included
Two-factor authentication is included on every plan for every role. No per-user fees, no identity provider upcharge.
Included
View all plansWhat else protects the account
Audit Log
Every login and security event is recorded for compliance.
Roles & Permissions
Five role types with fine-grained permissions.
Team Management
Invite techs and managers, set roles, and require 2FA on sensitive roles in one place.
Client Portal
Optional 2FA on client portal accounts for orgs that handle sensitive client data.
API Access
API keys are scoped per org with rotation independent of user 2FA so integrations never break on a TOTP rollover.
Ready to try Two-Factor Authentication?
Start your 14-day free trial. No credit card required.