A plain guide to keeping your account and your company's data safe. For the technical details behind the scenes, see the separate developer-facing Security reference.
Keeping your own account safe
- Use a strong, unique password — set or change it from User Profile → Change Password.
- Turn on the extra 6-digit security code (two-factor authentication) — see Login and Authentication for how to set it up. Save your backup codes somewhere safe; they're only shown to you once.
- Check your active sessions now and then — User Profile → Sessions shows every device currently signed in, and lets you sign out any you don't recognize.
- Glance at your recent sign-in history — your last 20 login attempts are listed in your profile; unfamiliar failed attempts are worth looking into.
Company-wide security settings (administrators)
An administrator can require everyone to enter a fresh 6-digit code before reviewing, approving, or reversing a posted entry — even if they're already logged in. (The reversal requirement also covers completing or reopening a bank reconciliation.) These are three separate switches in Settings — review, approval, and reversals — and all three are turned on by default for new organizations.
Security alerts
You'll automatically get notified (usually by email too) whenever the extra security code is turned on or off for your account, or a new way of signing in gets linked to it. See Notifications.
If you lose access to your account
- Forgot your password? Use the "Forgot password" link on the login page — see Login and Authentication.
- Lost your authenticator app and your backup codes? There's no way to recover this yourself — reach out to an administrator on your team for help.
A few things worth knowing
- Bank account numbers are stored encrypted and can only be viewed by people specifically given permission to reveal them — usually just administrators.
- Every important action — like changing permissions or posting a transaction — is permanently recorded in an activity log that can't be edited or deleted afterward, not even by an administrator.