Two-factor login
Add a second step to signing in, so a stolen password is not enough on its own. Save the recovery codes.
You hold other people's tax documents. Two-factor is the difference between someone having your password and someone having your clients' paperwork.
Turning it on
- Go to Settings, then Security & privacy.
- Start the setup. A QR code appears.
- Scan it with an authenticator app: Google Authenticator, 1Password, Authy, whichever you already use.
- Enter the six-digit code it shows you, to prove it worked.
- Save your recovery codes somewhere safe. See below, this is the important bit.
From then on, signing in asks for a code from your app as well as your password.
Requiring it for the whole firm
The firm owner can turn on Require two-factor for the firm under Settings, then Security & privacy. The owner must finish their own setup first. After the requirement is on, every firm member is sent through setup or verification before Vylan opens, and nobody can disable their own factor while the policy remains active.
The recovery codes
The recovery codes are your only way back in if you lose your phone. Not a support ticket, not an email to us. Save them somewhere that is not your phone: a password manager, or paper in a drawer. People skip this step and then lose their phone, and that is a genuinely bad day.
Each code works once. If you use some, generate a fresh set.
If you lose your phone
Sign in with a recovery code, then set up two-factor again under Settings, then Security & privacy. If your firm requires it, Vylan takes you directly to setup before opening any client data.