Offices and firm security
Set up locations, and require two-factor across your firm.
Two firm-level settings that are easier to get right early than to retrofit.
Offices
Add each location your firm operates from. Offices carry a colour, which is what makes a multi-office calendar and task list readable at a glance.
Staff are assigned to an office, and so is work. That gives you:
- Filtering tasks and clients by office
- Assignment that respects who's actually local
- Appointments that know which building they're in
Where no office is assigned you'll see None, and an office with nobody in it shows No staff assigned.
Set offices up before inviting your team. Assigning fifteen people afterwards is tedious, and work created in the meantime has no office on it.
Single-office firms can skip this entirely.
Require two-factor
Require two-factor for everyone at this firm does what it says. Once on, every member must set it up.
Turn it on. You hold client Social Security numbers, bank details, and tax returns. A password alone is not a defensible control over that material, and "we required two-factor" is a much better sentence than the alternative in any conversation that follows an incident.
The objection is always that it's friction for staff. It's a one-time setup and a few seconds at login, weighed against the entire contents of your client files.
Notes and limits
- Requiring two-factor applies to firm members, not to portal users.
- Offices can be deactivated rather than deleted, so historical assignment survives.
- Changing someone's office doesn't reassign their existing work.
- Office colour is display-only and carries no permission meaning.