Signing in and account security

Tidyflow gives you a few ways to sign in, plus some extra security options. This covers both the firm app and the client portal.

Tidyflow has two separate sign-in areas:

• Firm app (owners and staff): https://app.tidyflow.com
• Client portal (your clients): https://portal.tidyflow.com

Each area only accepts logins for that area, so make sure you are on the right one. If you are stuck getting in, see Trouble signing in to Tidyflow?.

---

Ways to sign in

Firm app (owners and staff)

On the login screen you can use any of these:

• A sign-in link. Click Email me a sign-in link and we email you a one-time link. There is nothing to remember.
• A password. Click Use password instead, then enter your email and password.
• Google, Microsoft, or Xero. If you already use one of these accounts, choose its button on the login screen to sign in with it.

Client portal (your clients)

On the portal login screen clients can use:

• A login link. Email me a login link sends a one-time link to their email.
• A password. Use password instead to enter their email and password.

If the firm uses two-step sign-in for clients, the portal asks for a second step after either one. See Choose how clients sign in.

The login screen remembers the last method used and marks it with a Last used badge next time.

---

Setting or changing a password

Everyone sets their own password. It is never assigned by anyone else, and Tidyflow never emails a password out.

• Firm app: Already signed in, for example through a sign-in link? Go to your profile settings, open the Security section, and choose Set password. Use Change password in that same section when updating an existing password.
• Client portal: Already signed in through a login link? Go to your portal profile and use the Set Password section. If you already have a password, that area is shown as Update Password.
• Locked out and cannot sign in at all? Use the Forgot password? link on the login screen to set a new one by email.

You do not need a current password if you have never set one.

---

Sign in with Google, Microsoft, or Xero

If you already use a Google, Microsoft, or Xero account, you can use it to sign in to the firm app instead of a password or link. Choose the matching button on the login screen and approve access once, then that account signs you in from then on.

This applies to firm users. The client portal uses login links and passwords.

---

Two-factor authentication

For an added layer of security, firm users can turn on two-factor authentication (2FA). At sign-in it asks for a short code from an authenticator app, on top of your password or sign-in link.

• Turn it on from your profile Security settings. You need a password set first, so add one there if you have not already.
• Require it for your team (Pro). On the Pro plan, workspace owners and admins can require two-factor authentication for everyone from Settings, so each team member is prompted to set it up. Personal 2FA is available on every plan.

To see who on your team signed in and from where, workspace owners can open the activity log. See Review your team’s sign-ins and activity.

---

Choose how clients sign in

On the Pro plan, owners and admins can require clients to complete a second step when they sign in to the client portal or the mobile app. Go to Settings, then Client portal, and choose an option under Client sign-in:

• Two steps with an authenticator app. Clients set up an authenticator app, such as Google Authenticator, at their next sign-in, then enter a code from it each time.
• Two steps with email. After a password, clients enter a code sent to their email. After an emailed link, they enter their password.
• One step. Clients sign in with their password or an emailed link.

Clients can tick Remember this device to skip the second step for 30 days, and can add an authenticator app from their portal profile even when you do not require one.

If a client loses their phone and has no recovery codes, open the contact and choose Reset authenticator app. They set it up again at their next sign-in.

---

Are sign-in links safe?

Yes. Each link can only be used a limited number of times, expires after a short time, and only ever goes to the account’s own verified email address, so it cannot be reused or shared to gain access.

---

Still need help?

If you cannot get in, see Trouble signing in to Tidyflow?, or contact support@tidyflow.com and let us know whether it is firm access or client portal access.