Keeping your account safe · EscBooks Help

Turning on two-step verification

With two-step verification on, signing in takes your password and then a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't open your books without your phone. It's off until you turn it on.

On Settings → Security, find Two-Step Verification (its badge says Off) and click Set Up Two-Step Verification. If you haven't proved it's you in the last 10 minutes, Confirm It's You asks for your password first.
A QR code appears. In your authenticator app (1Password, Google Authenticator, Authy or any app that makes 6-digit codes), add an account and scan it. If you can't scan, type the key shown beside it; the copy button copies it.
Type the 6-digit code the app shows under Code from the app. It checks as soon as the sixth digit is in, or click Verify. A code that doesn't match says so; type the newest one. Cancel stops without turning anything on.
The badge turns to On and the app is listed with the day it was added. EscBooks emails you to say two-step was added.

From then on, after your password the sign-in page asks you to Enter Your Code. With more than one app set up, pick which one under App. Two-step is checked by the database too, not only the sign-in page: a session that's past the password but hasn't entered its code can't change anything in your books.

Two-step works with an authenticator app. Codes by text message and passkeys aren't offered.

If you lose your phone

EscBooks doesn't have backup or recovery codes, so set up a second way in before you need it. Add Another App (on the same card, once two-step is on) adds another app: a second phone, a tablet, or a password manager that keeps codes. It asks for a code from the app you already have first. Either one's codes work, and the sign-in page lets you choose.

If you've lost every app, the sign-in page's Lost your phone? links to Contact support.

To take an app off, click Remove beside it and confirm, with a code if you haven't entered one in the last 10 minutes. Its codes stop working at once. Removing the last one turns two-step off, and signing in goes back to your password alone. Either way, you're emailed. If it says to sign out and back in with your code first, do that, then remove it.

Changing your password

In the Password card, type a New password (at least 8 characters) and the same again in Confirm new password.
Click Change Password. If you haven't proved it's you in the last 10 minutes, Confirm It's You asks first (below).
If you signed in more than a day ago, EscBooks also emails you a 6-digit code. Type it under Code from the email and click Change Password again. Send a new code sends another.

You'll see Password changed, and EscBooks emails you to say so. Forgot your password? On the sign-in page, click Forgot password? and EscBooks emails you a link to choose a new one. Choose it within an hour of opening the link. With two-step on, the link alone isn't enough: Enter Your Code asks for a code from your authenticator app first.

Confirm it's you

A few changes need proof that the person at the keyboard is you, so someone who finds your computer unlocked can't redirect your money or let someone into your books:

changing your password;
changing the payment details clients pay you with (bank name, account name, account and routing numbers, SWIFT code, payment link or payment instructions) once they're set. Filling in a blank one doesn't ask;
changing your Legal name in Settings → Business: it's who gets paid. The one you gave when you signed up didn't ask, and changing only the trade name doesn't. Every owner is emailed when it changes;
turning on two-step verification, adding another app to it, or removing one;
inviting someone to your books, a fresh link for an invite that's out (Copy Link or Resend), and removing someone's access (see Your accountant);
connecting an AI assistant, or letting one do more: something it couldn't do before, or more changes a day (see Connected assistants).

Confirm It's You asks for your current password, or, with two-step on, a code from your authenticator app. Click Confirm and the change goes ahead. It won't ask again for 10 minutes, and signing in counts: if you signed in within the last 10 minutes, it doesn't ask at all.

Each wrong password is recorded in Recent Activity. After five wrong tries in 15 minutes it stops checking for a few minutes.

The database itself refuses each of these changes without the proof, so it holds however the change is sent, not only from these pages. Your password and two-step go through the sign-in service, which can't say which of your browsers asked, so there proof from any browser you're signed in on counts. A password reset link counts for an hour after you open it, and with two-step on it needs a code from your app as well.

Taking access away doesn't ask for a password: cancelling an invite, turning an assistant off and signing out a device go ahead as soon as you answer a plain "are you sure?" (Sign out Safari on iPhone?), so after a scare you can shut things off without waiting on a password. Removing someone's access asks that question first too, then Confirm It's You only if you haven't signed in or confirmed in the last 10 minutes.

Sign out when away

Sign Out When Away signs this browser out after a stretch with no activity: After 15 minutes, 30 minutes, 1 hour, 4 hours or 8 hours. It's Never unless you choose, and it's worth choosing on a computer other people use.

Activity in any EscBooks tab counts. A minute before, Still There? counts down; click Stay Signed In to carry on. A computer that slept past the time signs out as it wakes. It only signs out the browser it's set on; your other devices keep their own time.

Where you're signed in

Where You're Signed In lists each browser signed in to your account, named the way you'd say it (Chrome on Mac, Safari on iPhone), with its IP address, when it was last active and the day it signed in. The one you're using says This device. The five most recent show; Show All lists the rest.

Sign Out beside one asks Sign out Safari on iPhone? (named for that browser); click Sign Out and it's ended. It has to sign in again with your password.
Sign Out of All Other Devices asks once, then ends every one but this, at once.

Signing out ends access straight away: from its next request, a signed-out browser can't read or change your books.

Recent Activity

Recent Activity, as it looks to

Your account

Your own sign-ins and changes. Everyone sees their own.

Signed in
Chrome on Mac · 203.0.113.24
Emailed for a new device
Password changed
Emailed to you
Sign-in email changed
alex@example.com
Emailed to you
Authenticator app added
Authenticator app
Emailed to you
Authenticator app removed
Authenticator app 2
Emailed to you
Wrong password entered to confirm a change
Safari on iPhone · 198.51.100.7
Recorded only

Your business

About the business itself. Only owners see these.

Payment details changed
account number (now ending 4821), routing number
Emailed to every owner
Legal name changed
Juniper Lane Design → Juniper Lane Design LLC
Emailed to every owner
morgan@example.com invited
As your accountant
Emailed to every owner
Claude connected
Emailed to every owner
Claude disconnected
Recorded only
Harbor Savings needed signing in again
Business Checking
Emailed to every owner
Tax ID viewed
Hollis & Reed, ending 6789
by your accountant, Dana Whitfield
Recorded only

The last 50 are kept on the page, the latest 10 showing, newest first. Made-up names and addresses.

Recent Activity, at the foot of Settings → Security, is the record of what's happened to your account and, if you're an owner, to your business. Each line shows what happened, a detail (the device and IP address, which fields changed, whose name), and the date and time. When someone else did it, it says who, by name (or email, if they haven't given a name): by your accountant, Dana Whitfield, or by another owner and their name. Someone who no longer has access shows as your former accountant. Warnings (an app removed, a wrong password, payment details or the legal name changed, a bank that needs you) have their icon in the warning color. The latest 10 show; Show All lists up to 50.

Sign-ins are recorded by the sign-in service itself, so one that skips the EscBooks sign-in page is caught too. Payment detail changes name the fields, never the old or new numbers: an account number shows only its new last four. A legal name change shows what it was and what it became.

Security emails

EscBooks emails your sign-in address when something important changes. These can't be turned off: someone who got into your account could otherwise switch them off before changing anything. Security Emails, on the same page, lists them:

New sign-ins: a sign-in from a browser and device you haven't used before. The same browser on the same computer or phone counts as the same device, whatever its IP address.
Password changed, Sign-in email changed and Two-step verification changed (an app added or removed).
For owners, to every owner: Payment details changed, Legal name changed (from what, to what), Someone invited to your books, Assistant connected, and Bank feed needs signing in again: when a bank feed needs you to sign in again, with a Reconnect link (and a reminder a week later, if it's still waiting). See When a bank feed stops.

How bank connections and tax IDs are kept

You sign in to your bank in Plaid's own window. EscBooks never sees your bank username or password. Plaid gives EscBooks an access token for the connection instead.
That access token is encrypted with a key held in Supabase Vault and kept in a private table that only the server's sync reads. It's never shown in the app, to your accountant or to an assistant. Disconnecting a bank deletes it.
A vendor's or subcontractor's tax ID is encrypted the same way, with its own Vault key. Their page shows the last four; Show fetches the whole number, and that's recorded in the owners' Recent Activity as Tax ID viewed, with who looked.

See Connecting a bank for the connection itself.