Security update: stronger admin MFA enforcement

All platform administrators must complete TOTP two-factor authentication before accessing sensitive modules.

Starting this month, admin accounts without TOTP enabled will be guided through setup on first login. This aligns with our compliance roadmap and reduces risk from credential theft. Super admins can reset MFA for locked-out users from the access panel. No action is required for merchant API integrations.

security mfa compliance