Whatever you're protecting, it starts at recovery.
The same back door, three reasons to lock it. Pick what fits.
Your money
A mandatory pause on resets, especially banking. An attacker can't drain it before you've even noticed.
Protect your money →From someone who knows you
When the threat already knows your answers, a password won't stop them. A second person, you, will.
More on this →Your family
Older parents and kids get hit hardest by reset scams. Be the second pair of eyes on the accounts that matter.
Protect your family →What the checkpoint actually does
All three cases below are the same back door: an account's recovery email. Whoever receives that email can take the account, password or no password. SAFE2RECOVER puts a person (you) in front of it.
You set it once. You change one setting on the accounts you want to protect: their recovery email becomes your SAFE2RECOVER address. Nothing else about how you log in changes.
Then it runs quietly. A login code arrives and we pass it through. A reset or recovery email arrives and we hold it. It never lands in your inbox and it never forwards anywhere.
You make the call. We ask you, by email on Free or by text: a password reset for your bank just arrived, was this you? Approve, snooze, or reject. If it wasn't you, the attacker is left with nothing and the link expires unused.
The detail, including how 2FA codes are treated differently from recovery mail, is on how it works.
Common questions
Does it change how I log in?
Your logins, your passwords and your apps stay exactly as they are. Two-factor and one-time codes pass straight through the checkpoint with no hold and no approval step. On Free, login codes and approval notices come by email after about 5 minutes. With text credit (or on a paid plan) they come by text, instantly. Logging in never waits on our say-so.
What actually gets held?
Only the mail that hands over an account: password resets, account-recovery requests and security-change confirmations. The rule of thumb is simple: if an email lets someone into your account without your password, we hold it; if it helps you log in, it passes through. A held email never lands in your inbox and never forwards anywhere.
What does an attacker see?
Nothing. They trigger the reset, the email goes into your checkpoint instead of your inbox, and the link expires unused. Attackers script the whole sequence (trigger the reset, click the link, change the password, lock you out) in under ninety seconds. The checkpoint breaks it at step one.
Is the protection weaker on the free plan?
No. The hold-and-approve protection is identical on every plan, including Free. What the paid plans change is speed and coverage: login codes texted instantly instead of emailed after a delay, held resets alerting your phone as well as your email, quiet hours and escalation, and more protected addresses: 3 on Bronze, 10 on Silver, 30 on Gold.
Can I undo it later?
Yes, in one step, any time. The checkpoint is a recovery address you point an account at, so removing it is the same single setting change that added it.