Secure by default

We show the same response whether the account exists or not.

Short expiry

Reset links expire after 30 minutes for extra protection.

Organisation-scoped

Organisation, login type and email keep the reset tied to the right account.