Passkeys, MFA and an audit log you can verify

Security that does not slow you down

Enterprise customers demand passkeys, MFA and audit trails. But those often mean friction: complicated setup, frustration during login, or security theatre that documents nothing you can actually verify. Yachtbase gives you all three without the friction, and with full proof.

Passkeys let you sign in with your phone or device fingerprint. No password to remember. No phishing attack works because there is no password to steal. MFA adds a time-based code from an authenticator app—a second factor that is encrypted and stored safely. An audit log records every action and sign-in, with the IP address, device, and a cryptographic chain that proves nobody has tampered with the log after the fact.

You can verify the audit chain yourself. Download the log and run a verification command. If even one entry has been changed or deleted, the verification fails. This is the kind of security that lawyers and regulators respect.

What you can do now

• Sign up with a passkey: Create a passkey during registration. Use your phone, computer or security key to sign in. No password needed.
• Add a passkey to an existing account: Go to Security settings, create a new passkey, and name it (e.g. "my iPhone" or "work laptop"). Use it to sign in on that device.
• Enable two-factor authentication: Choose TOTP (time-based one-time password) and scan the QR code with an authenticator app (Microsoft Authenticator, Google Authenticator, or similar). Each login after that requires the code from the app.
• View your sign-in history: See every sign-in with the date, time, IP address and device. If you see an unfamiliar sign-in, invalidate all sessions with one click.
• Access the audit log: View every action in Yachtbase—who created a booking, who edited a quote, who changed a client record, and when. Action types, user, timestamp, and what changed.
• Verify the audit chain: Export the audit log and run the verification command. Confirm that nobody has altered or deleted records.

Why it matters

A hacked password means someone has access to your entire workspace. A password sent over email is a security incident. An audit log you cannot trust is worse than no audit log at all.

Passkeys eliminate password attacks. Two-factor authentication blocks account takeovers even if a password is compromised. A verifiable audit log means you can prove compliance to regulators, lawyers and auditors. You can also investigate security incidents with confidence, knowing that the log is trustworthy.

Available

Available to every workspace on Core, Professional and Enterprise plans.