Two-factor authentication

Imagine this: thousands of unreleased production stills leak online. The root cause? A single compromised password on a shared drive. No second factor, no session monitoring, no way to know who had accessed what.

You can't afford that kind of exposure.

Why passwords aren't enough

If you work in entertainment, your photo library contains unreleased content, embargoed stills, and images of talent who have contractual control over their likeness. A password is a single point of failure. People reuse passwords. People fall for phishing. People write passwords on sticky notes.

Two-factor authentication means that even if someone gets your password, they still can't sign in without the 6-digit code from your authenticator app. It's the same approach banks, hospitals, and government agencies use for sensitive data.

ReelStorage includes 2FA on every plan because security shouldn't be gated behind an enterprise paywall.

How 2FA works in ReelStorage

The setup takes about 60 seconds:

1. Go to Settings in your account
2. Click Enable Two-Factor Authentication
3. Scan the QR code with your authenticator app
4. Enter the 6-digit code to confirm the link
5. Save your backup codes

From that point forward, every sign-in requires both your password and a fresh code from your authenticator. The code changes every 30 seconds, which means a stolen code is useless within a minute.

TOTP: the industry standard

ReelStorage uses TOTP (Time-based One-Time Passwords), the same standard used by GitHub, Google, and AWS. This means you can use whichever authenticator app you already have:

• Google Authenticator
• 1Password
• Authy
• Microsoft Authenticator
• Bitwarden

No proprietary app required. No SMS codes (which can be intercepted through SIM swapping). Just a proven cryptographic standard that generates offline codes on your device.

Backup codes: your safety net

When you enable 2FA, ReelStorage generates 10 one-time backup codes. Each code works exactly once. If you lose your phone, break it, or switch devices without transferring your authenticator, these codes let you sign back in and reconfigure 2FA.

Store them somewhere you won't lose them:

• In your password manager
• Printed and stored in a secure location
• In an encrypted note

If you've used all your backup codes and lose your device, you'll need to contact support to verify your identity and regain access.

Session management

2FA works best alongside good session hygiene. Your account settings show all active sessions, including the device, location, and when the session started. If you see something unfamiliar, you can revoke that session immediately.

This is particularly useful for:

• Shared workstations at a production office
• Traveling team members who sign in from hotel or airport Wi-Fi
• Post-project cleanup when you want to ensure no lingering sessions exist

Security for production environments

Productions handling NDA-protected content operate under strict security requirements. Distributors like Netflix, Amazon, and Apple have specific guidelines for how production materials should be stored and accessed.

2FA is a baseline requirement for most of these security frameworks. With ReelStorage, every team member can enable it at no extra cost, which means you're not choosing between security and budget.

What 2FA protects against

• Credential stuffing: Automated attacks using leaked password databases
• Phishing: Fake login pages that capture passwords but can't capture future TOTP codes
• Password reuse: When the same password is used across multiple services and one gets breached
• Unauthorized device access: Someone who borrows or steals a laptop can't sign in without the authenticator

What 2FA doesn't replace

2FA is one layer in a security stack. It works alongside role-based permissions (controlling what each person can do), activity logging (recording who did what), and proper access management (removing people when they leave). No single feature makes you secure; the combination does.

Free on every plan

We made a deliberate choice to include 2FA on all plans. If you're storing production photos, event stills, or any content that matters to your business, you should be able to protect it without upgrading to an enterprise tier.

Enable it today. It takes 60 seconds and it might save you from a very bad day.