How we protect your account sign-in

You sign in with Google or Apple, or with a one-time magic link, so there is no password to leak. Sessions are encrypted, and only valid email addresses can create an account. Access to your workspace is controlled by roles.

Written By Sergiu Biris

Last updated 10 days ago

Your account sign-in is built to avoid the most common ways accounts get compromised.

Passwordless by design

  • Sign in with Google or Apple, or a one-time magic link. There is no password for you to reuse, forget, or have leaked in a breach elsewhere.
  • Magic links are single-use and sent to your email, so only someone with access to your inbox can sign in.

Protecting the session and account

  • Encrypted sessions. Your session is kept in a secure, encrypted cookie.
  • Real emails only. Sign-up is limited to valid, non-disposable email addresses, which keeps fake and throwaway accounts out.
  • Role-based access. Once you are in, what you can see and do is controlled by your role, and your accountant is read-only.

Result

There is no password to steal, sign-in is tied to accounts you already trust (Google, Apple, or your email), and access inside your workspace is limited by role.

  • Invite a team member
  • Is my data secure?