How we protect your team’s 2FA secrets.
AES-256-GCM encryption at rest, per-account access control, step-up re-authentication before any secret can be exported, and instant revocation — with no browser extension to widen the attack surface. Below, we also set out plainly what this design does not protect against.
AES-256-GCM Vault
TOTP seed secrets are encrypted using Galois/Counter Mode (GCM) authenticated encryption. Keys are derived per workspace and never exposed in plain text.
Instant Access Revocation
When a contractor or employee departs, revoke access in 1-click. They immediately lose code generation access without needing to reconfigure 2FA keys across services.
Granular RBAC Roles
Enforce strict separation of duties. Viewers can generate and copy live passcodes, while Admins manage workspace membership and secret additions.
Real-Time Audit Logs
Every code view, copy action, and permission change is recorded with exact user ID, timestamp, user agent, and IP address for compliance auditing.
Zero Extension Risk
Unlike browser extension password managers vulnerable to DOM scraping and malicious extension hijacking, Pair2FA operates as a hardened standalone web application.
SOC 2 Cloud Infrastructure
Hosted on SOC 2 Type II and ISO 27001 compliant cloud data centers featuring automated continuous backups, DDoS mitigation, and TLS 1.3 encryption.
Role Permission Matrix
| Capability / Permission | Viewer Role | Admin Role | Workspace Owner |
|---|---|---|---|
| View Live 30s TOTP Passcodes | |||
| 1-Click Copy Passcode | |||
| Add New 2FA Secret / QR Code | — | ||
| Invite & Deoffboard Teammates | — | ||
| View Real-Time Audit Logs | — | ||
| Manage Billing & Subscription Tiers | — | — |
Which accounts should actually live in Pair2FA?
The controls above matter most where a platform gives you no safer option. These guides show where each platform's own team access ends — and where sharing a code is the remaining answer.