> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bizzyco.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Sign-in security, API keys, and how Bizzy protects your data

Secure how your team signs in, control programmatic access, and understand how
Bizzy protects your data.

## Sign-in security

<CardGroup cols={2}>
  <Card title="Passkeys" icon="fingerprint" href="/admin-guide/security/passkeys">
    Phishing-resistant sign-in with device biometrics
  </Card>

  <Card title="Two-Factor Authentication" icon="shield-halved" href="/admin-guide/security/two-factor">
    TOTP codes and backup codes
  </Card>
</CardGroup>

## Key Management

Bizzy uses **API Keys** for REST API access from backend services, scripts, and
integrations. API key management requires the **Owner** role.

<CardGroup cols={1}>
  <Card title="API Keys" icon="key" href="/admin-guide/security/api-keys">
    Create keys for REST API integrations
  </Card>
</CardGroup>

<Note>
  AI agents (Claude, Cursor, Windsurf, etc.) connect through the [MCP
  server](/mcp-server/introduction), which uses its own authentication flow
  rather than API keys.
</Note>

## Data protection

<CardGroup cols={1}>
  <Card title="Data Protection" icon="shield-check" href="/admin-guide/security/data-protection">
    Isolation, encryption in transit, AI data access, deletion and recovery
  </Card>
</CardGroup>

## Security Best Practices

* **Principle of least privilege**: Grant only the permissions each key needs
* **Separate keys per integration**: Create dedicated keys for each service or
  agent
* **Regular audits**: Review and revoke unused keys monthly
* **Secure storage**: Never commit keys to version control; use environment
  variables