Where people may sign in from
For each control, choose Off, Verify by email (allow, after an emailed check) or Refuse.
- Allowed networks — add an IP or range with a Label, such as the office connection.
- Advanced access controls — the kinds of device and browser allowed.
Two-factor authentication
Two-factor is set on the Security tab of Workspace › Users and Access, and there are three ways to ask for it.
- Require it for everyone — one switch, the whole company.
- By role — set a role to Required, and it stays required as people join and leave that role.
- One person — on the Users tab, set Require for this person. This works even when the company-wide switch is off.
Allowed methods decides what counts:
- Authenticator app — a code from Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other standard app. The strongest of the three.
- Email verification — a code sent to their address. Only as safe as that mailbox.
- Phone approval — a tap in the AccountHouse app on a phone they are already signed in on.
Reset authenticator, on a person’s row, is what to use when somebody loses their phone. They set up a new one at their next sign-in. Nobody — not you, not Accmerio — can see somebody’s existing authenticator, so resetting is the only option and that is deliberate.
Actions that always ask for a code
A few actions ask for a code from whoever is doing them — except the company's Owner — whatever this page is set to: changing who may do what, changing company settings, payroll, bank accounts, the Marketplace, business apps, and undoing something that has already posted.
The Owner is never asked. Whatever the company's Owner does in their own company goes ahead without a code; Administrators and everybody else are asked as described here. An Owner who turned two-factor on for their own account still uses it to sign in.
Each of those can widen somebody’s access, move money, or show what you are obliged to keep private. Asking once, at the moment it is used, is what stops an unlocked laptop being enough.
When an action needs a code from your authenticator, the Confirm it is you window is the only thing shown — no red message beside it. Once the code is accepted the action is done.
Setting the authenticator up is a one-time job. After that those actions ask for a code, not for another setup — once, and then not again for fifteen minutes. If you are asked to set one up when you already have one, that is a fault and not the intended behaviour; it was one until 21 September 2026.
Sessions and trusted devices
- Sessions: set the Maximum session length (hours) before people must sign in again, and Revoke any session.
- Trusted devices: set how long to Remember a verified device (days), and Revoke a device.