Is there two-factor authentication?

Not as its own setting today, and we would rather say so plainly than imply otherwise. Sign in with Google is the practical route to a second factor right now: if your Google account has two-factor enabled, then so does your access to nouz, and that is a real second factor rather than a checkbox.

What is in place regardless: sessions are signed and verified on every request, password resets are single use and expire, and the roles above limit what any one session can do even if it is misused.

If two-factor inside nouz itself matters for your business, tell support. Demand from actual merchants is what moves work up the list, and it is the sort of thing we would rather build because someone asked than guess at.