Security

How sign-in and a firm's data are protected, and where the limits are today.

• Passwords are stored as one-way hashes. A new password is checked against a list of leaked passwords, and only the first five characters of a hashed copy leave our server.
• Sign-in cookies are httpOnly. A session lasts 7 days, or 30 days if the person chooses to remember the device. A firm can also set an idle timeout; it is off until the firm turns it on.
• Two-factor sign-in with an authenticator app is available to everyone, and a firm can require it for all staff. Changing or turning off two-factor needs the password and a current code, and signs other devices out.
• Connection secrets, such as mailbox passwords and API keys, are stored encrypted. An API key is shown once, when it is made. A saved client portal password can be shown only to people the firm has allowed, only after they enter their own password again, and each time the owner and other admins are told and the activity log records it.
• Each request is checked against the signed-in person's firm and role before any data is read or written. Changes sent from another website are refused, and sign-in and other sensitive requests are rate limited.
• Uploaded files sit on the server's disk in a folder for each firm. Encryption of stored files and backups is planned and is not in place yet.
• Report a security concern through Help. We reply by email.

Last updated 19 October 2026.