Built like the books depend on it.

  • TOTP two-factor for every user
  • Trusted devices
  • Per-company IP allowlist (Business)
The Security screen in Nefin
File attachmentsBusiness units

What you get

Authenticator-based two-factor sign-in for every user, an immutable audit log, and one isolated database per company.

Two-factor, not optional

Every user enrols an authenticator app (Google Authenticator, 1Password, Authy…) at first sign-in. A password alone never opens a company's books.

Trusted devices, your call

Mark a laptop as trusted and skip the code on that device for a while. Review and revoke devices any time from Settings → Security.

IP allowlist with approvals

Business companies can restrict sign-in to office or VPN ranges. A sign-in from a new address emails an approval link, so a travelling owner is never locked out.

Frequently asked

Is two-factor authentication mandatory?

Yes. Every user enrols an authenticator app at first sign-in; there is no SMS or email-only fallback. Trusted devices let you skip the challenge on a device you use daily.

Which plan includes the IP allowlist?

The per-company IP allowlist is part of the Business plan. Two-factor authentication, trusted devices, the audit log and per-company database isolation are on every plan.

What happens if I sign in from a new IP while the allowlist is on?

The sign-in is held and an approval email is sent. Approving it adds the address either temporarily or permanently — your choice — and the sign-in completes.

Where is my data stored?

In AWS in the EU (Frankfurt), in a database dedicated to your company, encrypted at rest and in transit. Files go to private per-company storage served through signed links.

Works with

Browse all features →

Ready to run cleaner books?

Open Nefin in minutes. No credit card required.