Two-factor authentication

A password can be phished or reused. A second factor means a stolen password alone opens nothing — which matters when the account can read every client file in the firm.

Authenticator app

Works with Google Authenticator, Authy, 1Password, Microsoft Authenticator or any other TOTP app. Codes change every 30 seconds, and one step either side is accepted so a slightly wrong clock still works.