An accounting system holds your bank matching, your customer list and your tax returns, so the sign-in is worth ten minutes of attention.
None of what follows is a paid add-on. Charging extra for an account being hard to break into has always struck us as a strange way to price software.
What you can do
- Turn on two-factor authentication with any authenticator app.
- Set password rules for your whole company: strength, and expiry if you want it.
- Decide how long a session can sit idle before it signs itself out.
- Issue API keys for your own scripts and tools.
- Review login history: when, from where, and how.
- Reset a forgotten password by email, on a link that expires.
- Close your account through a defined process rather than a support request.
How it works in practice
Turn on two-factor authentication (Your profile → Security). Scan the code with whichever authenticator app you already use, then confirm with a code from it. That confirmation step is required, so an account can’t end up locked behind a code nobody can generate. After that, signing in asks for the app’s six digits once you’ve entered your password.
Set the rules for everyone else (Settings → Security). Password strength, whether passwords expire and after how many days, and the idle timeout that applies to every user in the company. The timeout is short by default, and it’s a setting rather than a fixed value because a shared machine at a trade counter and a private office genuinely want different numbers.
Issue an API key when something needs to talk to the system (Your profile → API keys). A key belongs to a person and carries that person’s permissions, which is the honest model: anything the key can do, the person could do. Treat it like a password, and remove it when whatever used it is retired.
Check the login history if something feels wrong. Every sign-in is recorded with its time, the address it came from and the country that resolves to. It’s the first place to look when you suspect a shared password, and the quickest way to confirm nothing untoward happened.
If you forget your password, the reset link is emailed to you and stays valid for a limited window. Requesting a new one invalidates the old.
Closing the account is a process with steps, not an email to support: the request, a confirmation, and a record that it happened. You’re asked why, which you’re free to ignore. Take your exports first - see getting your data in and out.
Good to know
- Two-factor authentication is per person, not per company. You can require it of yourself right now. Getting a colleague to turn theirs on is a conversation rather than a setting, and if everyone in your company handles money, it’s a conversation worth having.
- Authenticator apps only. Codes by email or SMS aren’t offered. Text messages in particular are the weakest common form of two-factor, and offering a weak option next to a strong one mostly gets the weak one chosen.
- Keep your recovery method. If you lose the device your authenticator lives on and have no backup, getting back in becomes a support matter with identity checks. Most authenticator apps offer a backup, so use it.
- An API key is as powerful as the person who owns it. There’s no separate, narrower key, which means a key belonging to an administrator can do administrator things. Create keys from an account whose permissions match the job.
- Permissions are what actually limit people, and they’re per company. See users, roles and companies. Sign-in security protects the account; roles decide what that account may do once it’s inside.
- Signing out everywhere isn’t the same as changing your password. If you think a password has leaked, change it. That’s what stops somebody who already has it.