No. The cards read only the enrolment flag, the timestamp, the role association, and the recovery-code counters. The TOTP secret itself never leaves the user meta row, which keeps the chart layer compatible with the plugin's security model.

Yes. Each card supports a filter on the WordPress role and on any custom user meta the site uses for department or team. A security-team view scoped to administrators shows admin-only coverage; a compliance view shows the full role mix.

Yes. The same data source feeds both, so an inline 2FA reset in the table view updates the donut on the next chart render. The charts are a second presentation over the same user table, not a separate dataset.

The bar card sums the recovery-code-used counter the plugin maintains per user. A user with eight codes generated and three consumed shows a bar of three, which makes lost-device situations visible the same week they happen.

Yes. The premium tier adds policy enforcement and app-password support but stores the same enrolment state in user meta. The charts read whatever fields are present, so policy-tier metadata can become its own chart card without configuration.

Yes. Each WordPress role keeps its own saved dashboard layout. Security leads see administrator coverage by default; compliance sees the rolling enrolment curve; IT ops sees recovery-code usage. Saved layouts ship per role without rebuilding the cards.

Charts query the live user meta on each render with paginated reads. The result is the same enrolment state the plugin's own user-list column would show, refreshed every time the dashboard loads.

Yes. Queries use the indexed user_id column on user meta. Sites with tens of thousands of accounts render the dashboard in well under a second, well inside admin page-load budget.