Two-factor authentication for applicant accounts is on the roadmap but not yet available. We currently use bcrypt-hashed passwords + session cookies + CSRF protection.
If 2FA is essential for your use case, use a strong unique password and clear your session when done.
Looking for your own record?
Everything we hold about you is one e-mail away, with a download and switches for each consent.