Browse help topics
- Help centre
- Security & Account
Security & Account
Manage two-factor authentication, recovery codes, data protection, and display preferences.
Security and Account covers how you protect your login and control your firm’s data. Two-factor authentication adds a second step at sign-in, so a stolen password on its own is not enough to get in, and you should generate recovery codes at the same time as a backup.
Passwords work slightly differently here to most products: there is no change-password screen inside dashboard settings, and you set a new one through a reset link emailed to you from the sign-in page. Settings, Security, which is admin only, is where you review how your data is processed and take a full export of your firm’s records in line with data protection law in your region. Display preferences, and account deletion, which removes the entire firm rather than one login, are covered here too.
Two-factor authentication and recovery codes
Security settings are admin-only: anybody else opening Settings, Security sees “Only administrators can manage security settings.” Turning 2FA on opens a setup window that generates a token, shows a QR code to scan with an authenticator app such as Google Authenticator or Authy, and then asks for the current six-digit code before it enables anything. Closing that window before you complete the verification step does not switch 2FA on, so there is no separate cancel action to hunt for.
Recovery codes are your way back in if the phone running your authenticator is lost, and you can only generate them once 2FA is active. Regenerating produces 10 new codes in one batch and immediately invalidates every code from the previous batch, including ones you never used. Each code works once. Download them as a .txt file and store them somewhere separate from the device running the authenticator app, because if both live on the same phone, losing it defeats the point entirely. Turning 2FA off removes every authenticator you have enrolled, not just one of them.
Passwords work differently here
There is no change-password screen anywhere in dashboard settings. You set a new password through a reset link emailed from the sign-in page, and the link that triggers it is not a permanent fixture on that page: it only appears after a sign-in attempt has failed. So the sequence is deliberately odd. Enter your email address, type anything into the password field, attempt to sign in, and then select “Forgot your password? Reset by email” in the error message that appears.
Two details matter. The reset goes to whatever address is currently typed into the Email field, so check it before you select the link. And the error message is deliberately generic (“Those credentials didn’t match. Please check your email, ID code, or password.”), so it will not tell you which of the two was actually wrong. Resetting a password does not touch your 2FA enrolment: you will still be asked for a code from your authenticator app, or a recovery code, afterwards. Setting a client’s portal PIN is an entirely separate feature that lives on the client’s own record, not here.
Data protection, export and deletion
The data protection card is headed “GDPR & Data Protection” for UK firms and “Data Protection Law (UAE)” for UAE firms. It states the retention policy: client data kept for 7 years from the end of an engagement, inactive client records automatically flagged for review once that period passes, and all data encrypted at rest and in transit. The DPA window itself cites UK GDPR or UAE Federal Decree-Law No. 45 of 2021 depending on your region, and its Security Measures section specifies AES-256 at rest and TLS 1.3 in transit.
Export All Data (JSON) produces a complete copy of your firm’s records: firm profile and branding, clients, jobs, tasks and timesheets, messages, file metadata and signatures, AML screenings and KYC sessions, compliance and system audit logs, and AI chat history. Credentials such as passwords, one-time codes and tokens are always excluded. Larger firms should expect it to take up to a minute, and the download link stays valid for 24 hours before you have to run it again. Exporting is non-destructive, so you can repeat it as often as you like.
Deletion is the opposite in every respect. Only the firm owner can carry it out, checked against the owner role specifically rather than admin, and it removes the whole firm: every team account, every client, job, task, timesheet, signature, message, file, AML and KYC record. A narrow set of records survives in pseudonymised rather than deleted form, the compliance audit log, the system log and the general audit ledger, with your email address replaced by a hashed value and the log content replaced by a redacted marker, because money laundering regulation requires that record-keeping. Your Stripe subscription is cancelled and the Stripe customer record removed as part of the same process.
Where your theme choice is stored
Your light or dark preference is saved in the browser you are using rather than on your Accupe account, so it has to be set separately on every browser and device you sign in from. Toggle it from the theme button in the top bar, or press Cmd+K (Ctrl+K on Windows and Linux) and choose “Toggle dark mode”. Accupe resolves the theme in a fixed order of priority: a t=dark or t=light value in the web address always wins, then your saved browser preference, then your device’s own light or dark setting. Clearing site data, switching browsers or opening a private window all put you back to the device setting until you toggle it again.
What people come here to do
- Turn on 2FA and save recovery codes. Enrolling an authenticator app, generating 10 single-use codes, and what turning 2FA off actually removes.
- Reset your password. Why the reset link only appears after a failed sign-in, and where the reset email is actually sent.
- Review the DPA and export your data. Retention policy, the region-specific legal basis, and what a full firm export does and does not include.
- Switch between light and dark. Where the toggle lives, why the choice is per browser, and how a themed link overrides it.
- Delete the firm’s account. Owner-only, permanent, and what narrow set of records is pseudonymised rather than erased.
5 articles in this category
Things that catch people out
The manual setup key for 2FA is not displayed
The setup screen notes that you can enter a key manually if you cannot scan, but Accupe does not actually print that key as text anywhere on the screen. If your device cannot scan a QR code, use your authenticator app’s own manual add-account option instead.
Regenerating recovery codes is not additive
It invalidates the entire previous batch, including codes you have never used. Only regenerate when you genuinely need a fresh set, or believe the existing codes have been seen by somebody else.
The DPA Download PDF button does not produce a file
It shows a confirmation message but generates nothing. If you need a record of the DPA text, copy it out of the window before you close it.
The data export is JSON only
The on-screen description mentions a JSON/CSV archive, but a single JSON file is what you actually get. Converting it into spreadsheet form is on you or your IT team.
An admin cannot delete the firm
Accupe checks for the owner role specifically. An admin who opens the confirmation window and tries anyway is blocked with “Only the firm owner can delete the firm.”
Deletion removes everybody’s access, not just yours
Every team member and every client loses access at once, and nobody can sign back in to retrieve anything afterwards. Run the export first if there is any chance the data will be wanted later, because deletion does not produce a copy for you.
Where to go next
- Team & Permissions. Who holds admin, and therefore who can reach Security at all, is decided in Team & Permissions.
- Billing & Subscriptions. Deleting a firm cancels the Stripe subscription, and both tiles sit behind the same admin-only Settings gate.
- Getting Started. The GDPR export button also appears on Settings, Firm Details, alongside your branding and portal configuration.