Two-factor authentication adds a second step to signing in: after your password, Yardstick asks for a six-digit code from an authenticator app. Even if someone learns your password, they cannot get in without your device.
Turn it on under Settings, in the Security section:
Open Two-factor authentication and confirm your password.
Scan the QR code with an authenticator app (1Password, Google Authenticator,
Authy, or any TOTP app).
Save your backup codes somewhere safe. They are shown only once.
Enter a code from the app to finish.
From then on, every password sign-in asks for a code. You can choose to trust a device you own for 60 days, so you are not prompted every time on it.
Backup codes are your recovery path: if you lose access to your authenticator, each backup code signs you in once. Keep them somewhere safe, separate from your password. To turn 2FA off, open the same card and confirm your password.
2FA protects your individual account and works on top of any workspace single sign-on. If your team signs in through an identity provider, you can also enforce MFA there.