Your books are yours, and access to them is explicit: nobody sees a company's books unless they were given that company, at a level you chose.
Inviting someone
From Settings, under Access, invite a person by email. They receive an invitation, set their own password, and land only in what you granted. An invitation that was never accepted can be withdrawn at any time.
Levels that match real life
Per company, a person can be:
- View: read everything, change nothing. Right for a partner or a lender's bookkeeper.
- Edit: do the bookkeeping.
- Company owner: everything, including granting others access to that company.
Your accountant is just a person with access to the companies they serve, at the level you decide; The accountant's manual walks them through what each level lets them do. Revoking access takes effect immediately, and what they did while they had it stays in the history, attributed to them by name.
One person, one session
An account can require that each sign-in is the only live one: signing in on a second computer signs the first one out. It is the simplest honest guard against a password being quietly shared, and it is on by default.
Signing in with Google
If your sign-in email is a Google account, you can connect it once and skip the password from then on. The first time you press Sign in with Google, we ask for your password one time to prove the account is yours; after that, Google alone signs you in. Your email and password keep working exactly as before - connecting Google adds a door, it never closes one. You can see and disconnect connected sign-ins any time from Preferences.
You can also sign up with Google in the first place: press the Google button at the top of the signup form and your books open right away - no confirmation email to wait for, and no password at all. Google is your one way in, so the connection cannot be removed until you add another (for example by setting a password later). If your address already signs in here, the same button simply signs you in.
A way back in: your recovery email
From Preferences, add a recovery email: a second address, different from the one you sign in with, used only if you ever lose access to your sign-in mailbox. It is not a login - it is where the way-back-in email goes. It starts working after you click the confirmation link we send there, and we notify your sign-in address whenever it changes.
If you are locked out of your sign-in mailbox, use Forgot password and choose to have the link sent to your recovery email instead.
When the mailbox itself is lost
If the sign-in mailbox is gone for good, an Owner on your account can change your sign-in email from Users & Access - pick the user, press Change email, type the new address. Nothing happens immediately: the old address (and the recovery email, if confirmed) gets a letter saying what will change and when, the change waits about three days, and one click from either letter stops it. The pending change shows on the user's card, where an Owner can also stop it.
If no other Owner can help, contact support - the same careful process runs there, with identity checks first. While a support-led recovery is being reviewed, the account's full export is paused as a safety measure; it comes back the moment the recovery resolves.
Two-step sign-in
After your password, a second proof that it is you: something you hold, not something you know. A stolen password alone then opens nothing.
- An authenticator app on your phone shows six digits that change every thirty seconds. Google Authenticator, Microsoft Authenticator, Authy and 1Password all work, they are free, and nothing is ever sent to you: the app and kBooks share one key, made when you scan the QR code.
- A passkey uses your face, fingerprint or device PIN through the device itself. Nothing to type, and it cannot be phished.
- Recovery codes are shown once when you turn two-step on. Each works once, typed where the six digits go, if you ever lose your phone. Keep them away from the phone; make a new set any time, which retires the old.
Turn it on under My preferences, or on the phone under Security. On the sign-in screen you can trust a browser for a while so a device that is yours is not asked every time; forget every browser if one is lost. An account owner can require two-step for everyone from Users & Access, in which case anyone who has not set it up is walked through it at their next sign-in, before anything else opens.
Watching the door
The user menu's Recent sign-ins shows every sign-in to your account: who, when, from where, including the failed attempts. If something there surprises you, change your password and review who holds access; both are two clicks from the same menu.