Account security

• Email verification is required before you can open Folevi.
• Folevi won’t accept a password that has appeared in a known data breach. It checks with Have I Been Pwned using only the first five characters of a scrambled (hashed) version of the password, so the password itself never leaves Folevi.
• Two-step verification with an authenticator app (TOTP) is optional; turn it on in Settings → Security.
• When you set up two-step verification you receive one-time recovery codes. Each works once. Store them somewhere safe, away from your password.
• Passkeys let you sign in with your fingerprint, face or screen lock instead of your password. Add one in Settings → Security (Folevi asks you to sign in again first if your last sign-in was more than 10 minutes ago), and rename or remove it there. Each passkey shows when it last signed you in, so one you no longer use is easy to spot. A passkey only works on Folevi, so it can’t be phished.
• With two-step verification on, a passkey that checks it’s you replaces both your password and the code. Admin accounts always sign in with a password and an authenticator code. Folevi for Mac can’t use passkeys yet; use them in your browser.
• You can delete your account at any time. If you own a workspace other people use, transfer it or delete it first. After a 7-day grace period, your account, your Personal and any workspace only you use are deleted permanently.

The full picture (encryption, what staff can and can’t see, and our subprocessors) is on the Security page. To report a vulnerability, email security@folevi.com. For anything else, write to support@folevi.com.