In one sentence
A password alone offers little protection for client case files: every lawyer can turn on two-factor sign-in, and the firm can require it for the whole team.
How to set it up
In the settings, section “Sign-in & security”, you scan a QR code with an authenticator app, for example on your work phone. From then on, sign-in asks for your password and a code from the app. You also receive one-time recovery codes, which you can save as a file or generate again. If you lose your phone, you sign in with one of these codes; we then send a notification email so that you notice if it was not you.
Mandatory for the team
In the “Firm & team” section, the owner finds the switch “Two-factor sign-in for the team”. Anyone who chooses “Require” must use two-factor sign-in themselves. Members then see a notice for 14 days; after that, they can open case files only once they have set up the second factor. An example: the firm turns on the requirement on the 1st of the month. From the 15th, a colleague without a second factor lands on the setup page instead of in the case file.
The check is not only in the interface: the server functions of the lawyer portal also check whether a session has passed the second factor before they return case file data.
Everything in one place
The settings are one page with seven sections: Profile, Account & plan, Firm & team, AI & privacy, Client portal, Notifications, and Sign-in & security. There you also see your active sign-ins and end individual sessions, for example on a forgotten laptop. After a longer period of inactivity, the portal signs you out; the firm can set a maximum duration for this.
What it does not do
- The second factor is a code from an authenticator app. SMS codes and passkeys are not available.
- Without a requirement from the firm, two-factor sign-in remains optional.
- There are no additional costs; the function is part of the subscription.
More: Security, Compliance for law firms and in the manual Sign-in, password and sessions.
