Signing in to Your Own Workspace

Our Commitment MountDev Ops is built security first. Your business data belongs to you, and you can export all of it at any time. We never use analytics or tracking of any kind inside MountDev Ops.

Your workspace can keep its own sign-in: the codes sent to your email, your passkeys, the devices you chose to stay signed in on, your backup email, and the places you signed in from. All of it stays in your workspace, in your data region, and nothing about it is kept anywhere shared. The sign-in cards look and work exactly as before.

Your company's sign-in moves to its own workspace only when your account is switched over. Until then, nothing changes for anyone, and signing in works the way it always has.

What Is Kept in Your Workspace

• Codes. A six-digit code is emailed when you ask for one. It works for 10 minutes, once, and you get five tries on each code. Only a scrambled form of the code is kept, never the code. Used and old codes stay as rows, marked used.
• Passkeys. Each passkey you added is kept with its name, when you made it, and when you last used it. A passkey works only on this website. A passkey whose use counter does not go up is refused, because it may have been copied. A passkey that is turned off stays listed, marked turned off.
• Stay signed in. If you choose to stay signed in on a device, the device gets a key that works for 30 days. Only a scrambled form of the key is kept. Signing out of the device ends it and keeps the row.
• Backup email. The address you can use to get back in if you lose your device.
• Places. The places you signed in from, so a new place can be told apart.

What Is Kept for Each Region

Each data region keeps one small list that says which workspaces in that region an email address signs in to. It holds a one-way scrambled form of the address and the workspace, nothing else: no readable address, no passkey, no session, and no code. The scrambling uses a key that is made inside the region and never leaves it, so a scrambled address cannot be turned back into an address, and the same address looks different in each region. There is no list that spans regions.

The page you type your address into keeps nothing: not the address, not the scrambled form, not what it found, and not a log of it. It asks each region at that moment and forgets.

Signing in with a Code

1. You type your address.
2. If it belongs to a person in your workspace, a code is emailed at once, at any hour. The answer on screen is the same whether or not the address belongs to anyone, so it never tells a stranger who has an account.
3. You type the code. A right code opens the workspace through the same hand-off as always, with no page load.

At most five codes an hour go to one person, and ten wrong tries in 15 minutes pause that person for the rest of it. A person who is turned off is sent nothing. If your workspace has no sending address set up in Settings, Email, no code is sent and the page is told.

Signing in with a Passkey

The page asks for a one-time challenge, your device answers it, and the answer is checked: it is for this website, the device saw you there, the signature is right for your saved passkey, and the challenge was made by your workspace and is used once. Each challenge lasts five minutes.

Moving Your Existing Sign-In

When your account is switched over, your passkeys, devices you stayed signed in on, backup email, and places are copied into your workspace in batches. Each batch is counted and checked against a fingerprint, and sending a batch twice adds nothing twice. Nothing is changed or removed in the copy. After the copy, every passkey and every active device still works.

Good to Know

• AI agents and API keys cannot sign anyone in or reach any of this.
• Nothing here appears in a log or in the Activity Log: no code, no key, and no address.
• Signing in still never loads a page, and the forms still work without script.