KapoMail staff

Two-factor authentication is required on every staff account. Staff can read across every customer on the platform, so a stolen password must not be enough on its own.