Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
Everything you own, in one click. The JSON export covers every table and leaves out every password, secret and token (the SMTP password, API keys, the Privara API key) and every webhook URL; after restoring it on a fresh install, re-enter your webhook URLs, as you do signing secrets. The database file is the rawest possible backup on SQLite installs and keeps everything.