Enable two-factor authentication

A password alone protects your backups only until it leaks. Two-factor authentication (2FA) means that even with your password, an attacker can't log in — and it takes two minutes to set up.

Why this matters for a backup account

Your CapyArk account is the key to your last line of defense. Someone who controls it can read your device list, reset SSH credentials, and delete snapshots. Ransomware operators specifically target backup accounts before encrypting the primary data — 2FA is the single most effective control against that.

What you need

Any free TOTP authenticator app:

Setup

1. Sign in at app.capyark.io and open Settings.
2. In the security section, start Two-Factor Setup. The wizard has three steps: introduction, QR code, confirmation.
3. Scan the QR code with your authenticator app (or copy the secret key manually if you can’t scan).
4. Save your backup codes — the wizard shows one-time recovery codes. Store them somewhere that is not the same device as your authenticator: a password manager, or printed in a drawer.
5. Enter the 6-digit code from your app to confirm. Done — from now on, logins ask for your password and a current code.

Recovery

• Lost your phone? Use one of the backup codes you saved during setup to log in, then re-enroll a new device in Settings.
• Lost the backup codes too? Contact support@capyark.com from your registered email address. We verify account ownership before removing 2FA — this is deliberately slow, because “support removed my 2FA quickly” is exactly the attack we’re protecting you from.

Good habits

• Enable 2FA before you load real data into your backups, not after.
• If your authenticator app supports encrypted backups (Aegis, 1Password), turn them on — it makes phone loss a non-event.
• Also see Security best practices for SSH keys and other account hardening.