Authentication
Password, plus a second verification factor, equals meaningfully stronger protection against a stolen or guessed password alone.
A password alone protects an account only as well as that password is kept secret. Multi-factor authentication (MFA) adds a second, independent check — something you have or something you are — so a leaked password isn't enough on its own to get in.
TPP's authentication options are at different stages of readiness, and this page names that honestly rather than implying they're all available today.
Interactive
What this covers
Current status
Both the staff dashboard and the client portal require an authenticated session before any tax data is shown.
Firm staff currently sign in with a password. Enforcing an additional verification factor for staff accounts is planned.
A dedicated second authentication factor for client portal logins, separate from staff authentication.
The TPP mobile app supports device biometric login. Your device's operating system handles the biometric check — TPP never receives or stores biometric data.
The enrollment flow for six-digit verification codes is built into the mobile app, but no authenticator or SMS provider is connected yet — it is not usable to protect a real account today.
Passwordless sign-in using device passkeys is on the roadmap.
Explore other security topics
Tax returns, W-2s, bank statements, and Social Security numbers deserve the same care whether they're moving between a client and TPP, or sitting in storage.
Learn more →A solo preparer, a reviewer, a billing coordinator, and a client all need different views into the same firm — TPP's role model is built around that reality.
Learn more →Every upload, view, and status change tells part of the story of a client's engagement — and part of the story of who accessed their sensitive information.
Learn more →30-day free trial. Full access to every feature during your trial, subject to the applicable trial terms.