Security & two-factor
Your LawnLedger account can send invoices, take payments and see every customer you have. It deserves better than a password you also use elsewhere.
Two-factor authentication
Two-factor means a password alone isn’t enough - a stolen one is useless without your phone.
Open your account settings
Click your name at the bottom of the sidebar, then My Account.
Turn on two-factor
Scan the QR code with an authenticator app - Google Authenticator, 1Password, Authy, whichever you already use.
Enter the six-digit code
This proves the app is set up before we turn the requirement on.
Save your recovery codes
Put them somewhere that isn’t your phone. They’re how you get back in if you lose it.
Recovery codes are shown once. If you lose both your phone and the codes, getting back in means proving who you are to support, which is slow on purpose - once they’re sure it’s you, they reset your two-step verification, sign you out everywhere, and you set it up again with your password.
Sign in with a passkey
A passkey is your device’s own unlock - Touch ID, Face ID, Windows Hello, or a hardware key like a YubiKey - standing in for a password. Add one under Settings → Company → Security, in the security keys card. From then on the login page offers it in the email field: pick it, unlock, and you’re in, with no password and no code. It counts as both.
Not every key can do that. The card marks the ones that sign you in on their own; the others still clear the two-step check after your password. Adding another key once you have one asks you to verify first, and we email you every time one is added - if you didn’t add it, remove it and change your password.
Passkeys on mobile
The crew app can ask for a passkey as its second step - your phone’s own fingerprint or face unlock instead of typing a code. It’s switched on per release, so if your phone offers it during sign-in, take it: it’s faster and phishing-resistant. If it doesn’t, nothing is wrong.
Requiring it for your whole team
Owners can require two-factor for everyone under Settings → Company → Security. Worth doing if your team handles payments or customer data, which in this business is everyone.
Give people a heads-up before you turn it on - they’ll be prompted at their next sign-in and will need a few minutes with their phone.
Sessions and sign-out
Signing out on a shared office computer actually matters. If you think an account is compromised, change the password - that ends the other sessions.
What we do on our side
- Passwords are hashed, never stored readably
- Payment card details never touch our servers - Stripe handles them
- Every tenant’s data is isolated at the database level, not just in application code
- Sensitive actions like impersonation are audit-logged