An accounting system holds your bank matching, your customer list and your tax returns, so the sign-in is worth ten minutes of attention.
Security isn’t a paid add-on. Charging extra for an account being hard to break into has always struck us as a strange way to price software.
What you can do
- Turn on two-factor authentication with any authenticator app.
- Set password rules for your whole company: strength, and expiry if you want it.
- Decide how long a session can sit idle before it signs itself out.
- Issue API keys for your own scripts and tools.
- Review login history: when, from where, and how.
- Reset a forgotten password by email, on a link that expires.
- Close your account through a defined process rather than a support request.
How it works in practice
Turn on two-factor authentication (Your profile → Security). Scan the code with whichever authenticator app you already use, then confirm with a code from it. That confirmation step is required, so an account can’t end up locked behind a code nobody can generate. After that, signing in asks for the app’s six digits once you’ve entered your password.
Set the rules for everyone else (Settings → Security). Password strength, whether passwords expire and after how many days, and the idle timeout that applies to every user in the company. The timeout is short by default, and it’s a setting rather than a fixed value because a shared machine at a trade counter and a private office genuinely want different numbers.
Issue an API key when something needs to talk to the system (Your profile → API keys). A key belongs to a person and carries that person’s permissions, which is the honest model: anything the key can do, the person could do. Treat it like a password, and remove it when whatever used it is retired.
Check the login history if something feels wrong. Every sign-in is recorded with its time, the address it came from and the country that resolves to. It’s the first place to look when you suspect a shared password, and the quickest way to confirm nothing untoward happened.
If you forget your password, use the Forgot password? link on the sign-in page. The reset link is emailed to you, lasts an hour, and works once: following it a second time, or forwarding the mail to somebody, gets them nowhere. You can ask for a new link once a minute.
Closing the account is a process with steps, not an email to support: the request, a confirmation, and a record that it happened. You’re asked why, which you’re free to ignore. Take your exports first - see getting your data in and out.
Good to know
- Two-factor authentication is per person, not per company. You can require it of yourself right now. Getting a colleague to turn theirs on is a conversation rather than a setting, and if everyone in your company handles money, it’s a conversation worth having.
- Authenticator apps only. Codes by email or SMS aren’t offered. Text messages in particular are the weakest common form of two-factor, and offering a weak option next to a strong one mostly gets the weak one chosen.
- Keep your recovery method. If you lose the device your authenticator lives on and have no backup, getting back in becomes a support matter with identity checks. Most authenticator apps offer a backup, so use it.
- An API key is as powerful as the person who owns it. There’s no separate, narrower key, which means a key belonging to an administrator can do administrator things. Create keys from an account whose permissions match the job.
- Permissions are what actually limit people, and they’re per company. See users, roles and companies. Sign-in security protects the account; roles decide what that account may do once it’s inside.
- A password reset says the same thing whether or not you have an account. The page confirms the mail was sent either way, because a message saying “no account with that email” would tell anyone who asked which addresses are worth attacking. If nothing arrives, check the address you typed.
- Sign up on an address you’ll still have next year. Throwaway mailboxes are turned away at registration, and the message says why. Everything that gets an account back - the verification link, and every password reset after it - arrives by email, so a mailbox anybody can open and nobody owns is an account nobody can recover.
- Signing out everywhere isn’t the same as changing your password. If you think a password has leaked, change it. That’s what stops somebody who already has it.