Security & two-factor
Your LawnLedger account can send invoices, take payments and see every customer you have. It deserves better than a password you also use elsewhere.
Two-factor authentication
Two-factor means a password alone isn’t enough — a stolen one is useless without your phone.
Open your account settings
Click your name at the bottom of the sidebar, then My Account.
Turn on two-factor
Scan the QR code with an authenticator app — Google Authenticator, 1Password, Authy, whichever you already use.
Enter the six-digit code
This proves the app is set up before we turn the requirement on.
Save your recovery codes
Put them somewhere that isn’t your phone. They’re how you get back in if you lose it.
Recovery codes are shown once. If you lose both your phone and the codes, getting back in means proving who you are to support, which is slow on purpose.
Passkeys on mobile
The mobile app supports passkeys — your phone’s own fingerprint or face unlock instead of typing a code. If your phone offers it during sign-in, take it: it’s faster and phishing-resistant.
Requiring it for your whole team
Owners can require two-factor for everyone under Settings → Company → Security. Worth doing if your team handles payments or customer data, which in this business is everyone.
Give people a heads-up before you turn it on — they’ll be prompted at their next sign-in and will need a few minutes with their phone.
Sessions and sign-out
Signing out on a shared office computer actually matters. If you think an account is compromised, change the password — that ends the other sessions.
What we do on our side
- Passwords are hashed, never stored readably
- Payment card details never touch our servers — Stripe handles them
- Every tenant’s data is isolated at the database level, not just in application code
- Sensitive actions like impersonation are audit-logged