Account & security
Sign-in & two-factor
Secure your account with two-factor authentication (TOTP) from Settings. Once enabled, you'll enter a code from your authenticator app at sign-in. Keep your recovery codes somewhere safe — they let you back in if you lose the device.
Sessions
You can review and sign out active sessions from Settings. Signing out everywhere is the fastest response if you think a session is compromised.
How your credentials are protected
Signing material (Android keystores, Apple certificates, Google Play service accounts) and API keys are never stored in plain text:
- Signing credentials are sealed with envelope encryption backed by a
hardware key vault, and decrypted only in memory for the moment a build needs them — never returned to the UI or written to logs.
- API keys are stored hashed. The full key is shown once at creation and can't
be retrieved afterward; revoke and recreate if it's ever exposed.
Data & compliance
See the Privacy Policy, Terms, and DPA (linked in the app footer) for how data is handled. For security questions or to report an issue, contact support@mybuildstack.com.