Turn it on in Settings → Security. After you sign in with Google, GitHub or your email link, Postbase asks for a 6-digit code from your authenticator app (1Password, Google Authenticator, Authy and others).
Add a second device as a backup. Sensitive actions, like deleting a workspace, ask for a code again.