Two-factor authentication
Adds a one-time code from an authenticator app on top of the password, so a password alone is no longer enough to get in.
Who it is for: Each user, on their own account — and a workspace owner can require it for the whole team.
In practice: A member of your team hands a password to a phishing page. With 2FA on, that password is worthless: the code lives only on their phone.
Works with any standard authenticator app — Google Authenticator, Microsoft Authenticator, Authy, 1Password and others. No SMS, no extra cost, no vendor lock-in. Setup is a QR scan plus one confirming code, so the account is only protected once a real code has been proven and nobody can lock themselves out by scanning into the wrong app. Eight single-use recovery codes are issued for a lost or replaced phone. And nobody can see or manage another person's 2FA — not a colleague, not the workspace owner, not LetsBot support.
Session timeout policies
Two independent settings per workspace: sign out after a period of inactivity, and a maximum session length regardless of activity.
Who it is for: The workspace owner, applied across the whole team.
In practice: Someone leaves the account open on a shared machine at the end of a shift. The session expires on its own instead of staying open until morning.
It applies even to people who chose "keep me signed in" — that is the point of the control. Particularly useful for shared computers, agency desks, and retail counters.
IP restrictions
A workspace lists the addresses its team signs in from — single addresses or whole ranges, IPv6 included.
Who it is for: The workspace owner, and teams working from an office network or a VPN.
In practice: A password is stolen from outside your network. It is useless, because a sign-in from any address that is not on the list is refused.
There is built-in protection against locking yourself out: the workspace cannot save a list that does not include the address it is being saved from, and the screen shows you that address.
Security activity log
Records every security-relevant event: sign-in, failed sign-in, sign-out, two-factor setup / enable / disable, two-factor verification (success and failure), recovery-code use, session expiry, access denied by an IP restriction, and any change to the workspace's own security settings.
Who it is for: The workspace owner, and anyone who needs a documented answer during a review or a security enquiry.
In practice: An enterprise customer asks for a record of who accessed your account and when. You export the log and send it, and the recipient can verify its integrity themselves.
Each entry carries who, when, from which address, and the outcome. The log is tamper-evident: entries are append-only and cryptographically chained with SHA-256, so any later edit or deletion is detectable and independently verifiable. It exports as CSV or JSONL, and the export carries its own integrity verdict so a recipient can re-check it rather than take it on trust. Available in Arabic, English, Portuguese and Spanish.
Role-based access
Granular per-permission roles per workspace, defining exactly what each member can see and do.
Who it is for: Any team larger than one person.
In practice: A support agent should read conversations without reaching billing or channel settings. You give them a role that contains only what they need.
Roles are already part of the platform; they are listed here to complete the picture.
