Securing Your Backup Account with Two-Factor Authentication

Your backup account holds the keys to your entire data recovery strategy. If someone gains access to it, they could delete your backups, download sensitive data, or revoke your API keys — leaving you defenseless exactly when you need protection most. That’s why Calm Backup now supports two-factor authentication (2FA).

Why 2FA for Your Backup Account?

Most developers understand that production databases need strong authentication. But the backup account often gets overlooked — protected by nothing more than a password that might be shared in a team wiki or stored in a password manager alongside dozens of other credentials.

Consider this scenario: an attacker gets access to a team member’s password vault. They can log into your backup dashboard, delete all backup history, regenerate API keys (breaking automated backups), and then attack your production database. When you go to restore, there’s nothing there.

Two-factor authentication blocks this entire attack vector. Even with a valid password, the attacker can’t get past the 2FA challenge.

How to Enable 2FA in Calm Backup

Enabling two-factor authentication takes about 30 seconds:

Navigate to Settings → Security in your Calm Backup dashboard

Click Enable 2FA

Scan the QR code with your preferred TOTP app (Google Authenticator, Authy, 1Password, etc.)

Enter the 6-digit code to confirm setup

Save your recovery codes in a secure location

TOTP-Based Authentication

Calm Backup uses Time-based One-Time Passwords (TOTP), the same standard used by GitHub, AWS, and every other service that takes security seriously. Your authenticator app generates a new 6-digit code every 30 seconds. No SMS messages that can be intercepted, no email codes that sit in an inbox — just a cryptographic code that only your device can generate.

If you can’t scan the QR code (common on servers without a display), Calm Backup also provides a manual setup key you can type directly into your authenticator app.

Recovery Codes: Your Safety Net

When you enable 2FA, Calm Backup generates a set of one-time recovery codes. Each code can be used exactly once to bypass the 2FA challenge — for situations where you’ve lost access to your authenticator app.

Store these codes securely. Print them and keep them in a safe, save them in a separate password manager, or store them in an encrypted file on a different device. If you lose both your authenticator and your recovery codes, you’ll need to contact support to regain access — and that process is intentionally slow to prevent social engineering attacks.

What Changes After Enabling 2FA

After enabling two-factor authentication:

Login requires a code. After entering your email and password, you’ll be prompted for a 6-digit TOTP code.

API keys are unaffected. Your backup sources continue to use their API keys for server-to-server authentication. 2FA only applies to the web dashboard login.

Sensitive actions require confirmation. Accessing security settings, regenerating API keys, and deleting backups require password confirmation as an additional safeguard.

Best Practices

Use a dedicated authenticator app rather than SMS-based 2FA. TOTP apps work offline and can’t be SIM-swapped.

Enable 2FA on day one. Don’t wait until you have production backups running. Set it up when you create your account.

Test your recovery codes. After saving them, try using one to log in. Then you know they work before you actually need them.

Rotate recovery codes periodically. If you’ve used some codes, generate a fresh set from the security settings page.

The Bigger Picture

Your backup system is your last line of defense. If everything else fails — your servers, your databases, your deployment pipeline — backups are what bring you back. Protecting access to that system with only a password is like locking your front door but leaving the back door wide open.

Two-factor authentication is the minimum viable security for any account that holds your recovery strategy. Enable it today — it takes 30 seconds and could save your business.