Passkeys, two-step verification and timezone-aware teams

Teams on Afren work across countries and across clocks, and they trade real money. That raises two questions every week. Can I be sure it is you signing in? And do we agree on when something is due? Passwords are guessed, reused and typed into convincing fake pages. And "Friday" means different moments in Lagos, Lisbon and Los Angeles.

This release addresses both, and it also changes how much of Afren you need to use. You can plan with us and build with people you already know, or hire straight into a contract.

Passkeys

A passkey lets you sign in with your fingerprint, your face or your device PIN instead of a password. Add one in Settings, under Security. From then on, the sign-in page offers a passkey button first. Select it, and your browser offers the passkeys it holds for Afren. You do not type an email address.

Passkeys use the WebAuthn and FIDO2 standards. Your device generates a pair of keys. The private key stays on your device and never reaches us. We keep only the public key, which can check a signature but cannot create one. Each passkey is bound to afren.ai, so a lookalike site cannot ask your device to sign in on its behalf. That is what makes passkeys resistant to phishing by design: there is no secret for you to hand over. Because the check happens on your device, we also require it to confirm you are present with a fingerprint, face or PIN, so a laptop left open on a desk is not enough on its own.

Some behaviours worth knowing:

• Your password keeps working. A passkey is an added way in, so you can adopt it at your own pace.
• Cancel the browser dialog and nothing happens, with no error to dismiss. If a passkey fails for another reason, the message says so and points you back to your password.
• We ask for nothing about your device beyond what verification needs, and your device will refuse to register a second passkey for itself.
• Your list shows each passkey with a label, when it was added, when it was last used and whether it is backed up by your device's own sync.
• Lost a device? Remove its passkey from the list and it can no longer sign in.

Two-step verification

For accounts that still sign in with a password, you can turn on two-step verification with time-based one-time codes, known as TOTP and defined in RFC 6238. Scan a code with any standard authenticator app, and the app produces a six-digit number that changes every thirty seconds. When you sign in with your password from a device we do not recognise, we ask for the current number as well. We accept the adjacent numbers too, so a phone clock that has drifted slightly does not lock you out.

When you turn it on, you receive a set of single-use recovery codes, shown once. If you lose your phone, enter one instead of the six-digit number. Each works one time, and we keep only a one-way fingerprint of each, so we cannot show them to you again. Save them somewhere other than the phone.

You can also mark a device as trusted, so the code step does not repeat on it for a while. The list of trusted devices shows what each one is and when it was last used, and you can remove any of them at any time. Turning two-step verification off asks for a current code, so someone at an unattended screen cannot quietly remove it. Signing in with a passkey does not need the extra code, because a passkey already proves both possession of your device and your presence.

Timezones that hold up

Afren detects your IANA time zone, the standard names such as Africa/Lagos or Europe/Belgrade, from your browser. Every moment we store is held in UTC, the single global reference time, and shown to each person in their own zone. That one rule does a great deal of work. Deadlines, meetings and reminders mean the same instant to everyone, and they stay correct through daylight-saving changes, which begin on different dates in different countries.

Contract deadlines follow the same logic. A due date is anchored to the end of the delivering person's own day, so "due Friday" means Friday night for the person who has to deliver, not midnight somewhere else. Task reminders arrive in each person's local morning, and a birthday falls on your own calendar date. Your team chat shows each teammate's current local time and how far ahead or behind they are.

Afren checks your browser's zone when you open it, so if you relocate or travel, your zone follows you. Stored deadlines never move, because they are fixed instants. Only the way they are displayed changes. We store the instant rather than the wall-clock text because a time written without a zone is ambiguous.

Other changes in this release

• Bring your own team. Choose planning-only mode and Afren produces your scope, plan and documents so you can build with people you already know. Confirming your scope moves the project straight to an active plan, and talent matching does not apply.
• Market and opportunity analysis. Your scope now includes a view of the market, competitors and opportunity, so you can judge the idea before committing budget.
• Hire straight into a contract. Start a contract directly from a talent profile, without going through the builder first.
• Choose how your team works. The team can agree the way it likes to work. A proposal applies once most of the team confirms it, or at once for a team of one, and the AI project manager plans around the agreement.
• Amounts in the right currency. Contracts are written in US dollars. Clients see dollar amounts, with the talent's original ask in their own currency shown alongside.
• Birthday balloons. On your birthday, balloons float up once for the year on a given browser. They are skipped if your device asks to reduce motion.

What this means for you

You can replace a guessable password with a passkey, or add a second step to one, and keep a way back if you lose a phone. Deadlines mean the same moment to everyone on a contract, wherever they are. And you can start from planning or from a hire, depending on how much of Afren you want to use.