Account security: passkeys, MFA and sessions

Your designs can be valuable, so account security matters. Solid Vibes gives you modern options, and a few minutes of setup makes your account much harder to break into.

You can find everything below under Account, Security. Press ⌘K (or Ctrl + K) and type security, passkey, mfa or sessions to jump there.

Ways to sign in

• Email and password
• Magic link: a one-time link sent to your email
• Google, Apple, GitHub or Microsoft (shown when available)
• Passkey: sign in with your device's fingerprint, face or PIN

You can have several. Having more than one is a good thing, because it means a lost device does not lock you out.

Passkeys: the best default

A passkey replaces your password with a cryptographic key stored on your device or in your password manager. It cannot be phished, because it only works on the real Solid Vibes site, and there is nothing to type or steal.

To add one: go to Account, Security, Passkeys, and choose Add passkey. Follow your browser or device prompt. You are also offered one right after you sign up.

• You can add passkeys for several devices.
• You can rename them ("MacBook", "Phone") and remove any you no longer use.
• If your browser or device does not support passkeys, you will see a message, and the other methods still work.

Two-step verification (MFA)

MFA adds a second proof when you sign in. Solid Vibes supports:

• An authenticator app (TOTP): scan a QR code with an app such as 1Password, Authy, or Google Authenticator. You then enter a 6-digit code that changes every 30 seconds.
• A security key: a hardware key you tap.

To set it up: Account, Security, choose the method, and follow the steps. If a code does not match, use the newest code from your app, and check that your device clock is correct.

Sessions and devices

Under Account, Security, you can see where you are signed in and sign out of any session remotely. If you ever lose a device, or use a shared computer, sign it out from here.

When you sign in, you can choose remember this device to cut down on repeated prompts on a computer you trust. Do not choose it on shared machines.

What Solid Vibes does behind the scenes

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Data isolation: database row-level security on every table, tested continuously, so one account's data cannot be read by another.
• Private storage for your files, accessed with short-lived signed links, with virus scanning on upload and file type validation.
• Secrets stay on the server. API keys are never in your browser.
• Rate limiting and abuse protection on sign-in, AI and export, and bot protection on signup.
• Secure session cookies.
• Dependency scanning, strict content security policy and independent security testing as part of how we build.
• Admin accountability: staff access is limited by role, protected with MFA, and logged.

Compliance programs such as SOC 2 Type II and ISO 27001 are on our roadmap. They are not yet certifications.

A 5-minute security checklist

1. Add a passkey.
2. Add an authenticator app as a second method.
3. Review your sessions and sign out of any you do not recognize.
4. Use a unique password from a password manager, if you use a password at all.
5. Check your email account's security too, since magic links and resets go there.
6. Review which links you have shared, and revoke old ones.

If something looks wrong

• Unexpected sign-in emails or codes: change your password, sign out other sessions, and check your MFA methods.
• A device is lost: sign it out remotely, then remove its passkey.
• You are locked out: use another sign-in method you have set up. If none works, contact support.

Solid Vibes staff will never ask for your password or a verification code.

Try it

Open Account, Security. Add a passkey, give it a name that describes the device, and then open a private browser window to test signing in with it.