Security that stays out of the way
Social sign-in, two-factor authentication, backup codes, and step-up checks — how Acme protects your workspace without slowing daily work.
Security features usually fail in one of two directions. Either they are so demanding that people route around them, or they are so invisible that nobody can tell what is protected. Acme aims for a third path: security you notice exactly when it matters, and never otherwise.
Signing in without ceremony
You can sign in with a social provider or with your email. The email path is progressive — Acme asks for your address first and only reveals what it needs next, so the common case stays a two-step flow. There are no CAPTCHAs to squint at and no security questions about your first pet.
Two-factor authentication, done properly
Any account can enable two-factor authentication from the Security page:
- Scan the QR code with the authenticator app you already use.
- Confirm one code to prove the pairing worked.
- Save your backup codes — shown once, copyable, and each usable a single time if you lose your device.
After that, a second factor is required at sign-in. Enrollment takes about a minute and can be turned off just as clearly if your needs change.
Step-up checks for the actions that deserve them
Day-to-day work — creating tasks, editing them, reading the dashboard — never interrupts you. But some actions are different in kind, not just degree: changing a member's role, removing someone, deleting a workspace or account. For those, Acme asks you to re-verify before proceeding, and truly irreversible actions require you to type out what you are about to destroy.
This is deliberate. A confirmation dialog you click through in half a second protects nothing. A re-verification step at the moment of consequence protects the workspace even if a laptop is left unlocked.
Roles as a security boundary
Every workspace member holds an explicit role, and every action is checked against it — in the interface and at the data layer beneath it. A member who cannot manage billing doesn't see a broken billing page; they see an honest explanation of what their role allows.
Security in Acme is not a settings page you visit once. It is the shape of the product: quiet by default, firm at the edges.