Passwords
Passwords need at least 12 characters and cannot be your email address or the part before the @. When the breach check is switched on, a password found in a known data breach is refused. Changing your password needs the current one and signs out every other session. Wrong password, unknown email and inactive account all answer the same "Invalid email or password", and repeated failures from one address are rate limited.
Two-factor authentication
Settings > Account > Security sets up a code from an authenticator app (Google Authenticator, 1Password and the like). Setup shows a QR code and 10 one-time backup codes, shown only once; each backup code works once if you lose the app. Enable needs a real code. At login, after the password, the page asks for the 6-digit code, and the challenge is valid for 5 minutes. Disabling needs your password. There is no SMS option.
Your operator can require two-factor for every account or for platform admins only. When required and not yet set up, requests answer 403 until you enrol and sign in again.
Sessions
An access token lasts 30 minutes and is renewed silently from a 7-day refresh token kept in an HttpOnly cookie. When the refresh token is gone, the next request sends you to the login page with reason=expired. Sign out ends the current session. Sign out everywhere (logout-all) revokes every refresh token at once. There is no list of active sessions, no per-session revoke and no idle timeout; use Sign out everywhere or a password change when in doubt.
Step-up and API keys
A few high-sensitivity actions ask for your password (and code, when enabled) again and are valid for 5 minutes. API keys (/vendor/api-keys) are scoped to your company with read access to contracts and bids; the key is shown once at creation, and you can revoke your own keys.