Account security on blitz.cloud - passkeys, 2FA and sessions

You can sign in to blitz.cloud with an email address and password, with GitHub, or with Google. From Settings you can add passkeys, turn on two-step verification with an authenticator app, and sign out any device the account is signed in on.

Signing up and in

Sign-in runs on login.blitz.cloud, our own Keycloak server in the same EU data centre as everything else. No third-party login service sits in between unless you choose GitHub or Google.

• Passwords must be at least 10 characters.
• Email signups have to confirm their address before creating apps or databases.
• Repeated failed sign-ins slow down and then lock the account for a while, to stop password guessing.
• Throwaway email providers are refused at signup.

Passkeys

Add a passkey in Settings under sign-in and security, and give it a name so you can tell them apart later. The sign-in page offers the passkey your browser or phone already has, so you don't type anything.

Two-step verification

Turn on two-step verification in Settings and scan the code with an authenticator app that supports TOTP, such as Aegis, 2FAS, 1Password or Google Authenticator. From then on, signing in with a password also asks for the six-digit code.

Sessions

Settings lists every device the account is signed in on. You can sign out a single device, or every device except the one you're using.

Linking GitHub or Google

You can add GitHub or Google as another way to sign in to an existing account. If the account has no password, linking asks you to confirm with the provider you already use.

Changing your sign-in email

Settings sends you to the same form as a password change. Nothing changes until you click the link we send to the new address, and the old address gets a note that it was changed.

Your activity

Settings lists what happened on your account, newest first: what you changed, what your AI assistant or GitHub changed, and what we changed. If something looks wrong there, write to hallo@blitzworks.io.

Notifications

We send mail from noreply@blitz.cloud when a deploy fails or succeeds, when an app is stopped, when a restore has finished and when an app got an overnight update. You can switch each topic off under Settings > Notifications, or with one click in the mail itself. Mail about your account, its security and billing always comes. News only comes if you switch it on.

What we don't see

Password changes, passkey setup and two-step verification happen on the sign-in server's own pages. The dashboard never handles your password or your authenticator secret.

Downloading your data

"Download my data" in Settings gives you one file with everything we hold about the account: your apps and their settings, databases, domains, builds and history. The files your apps keep on disk and what is inside your databases are not in it. For those, write to hallo@blitzworks.io.

Deleting your account

You can delete the account yourself, in Settings. Before you confirm, it lists what goes: your apps by name, your databases and their nightly copies, the domains that stop working here, and how long your blitz.cloud address is held before someone else can take it. You type your email address to confirm. If you have Pro, it ends at once, so nothing is charged again.

The apps, the data and every copy are gone within a day. You can sign up again with the same email address whenever you like.