Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
Everything you own, in one click — and the two files are not interchangeable. The JSON export covers every table with credentials stripped: password hashes, API-key hashes, SMTP and OIDC secrets, the backup and calendar tokens, each subject's verification token, and webhook URLs (matched by pattern; after restoring it on a fresh install, re-enter your webhook URLs, as you do signing secrets). That is the one you can hand to a bookkeeper, a contractor or a subprocessor. The database file is the whole install, nothing removed — the right choice for bare-metal recovery, and it should be treated exactly as you treat the server itself. Restoring the JSON onto a working install keeps that install's own secrets rather than overwriting them with the redaction marker.