Security & multi-user access
Security and multi-user access in cloud accounting
Your books move behind a login. This page explains how cloud accounting platforms protect that access, how you share it with staff and accountants without handing over more than they need, and what to check before you commit.
The baseline: multi-factor authentication
Multi-factor authentication is the security feature Singapore buyers now expect as standard. Xero's Singapore pages highlight secure MFA for cloud access, and it is a reasonable benchmark to hold other platforms to. MFA means a password alone is not enough to get in; a second factor confirms it is you.
For accounting software holding bank feeds, payroll data, and GST records, that extra step matters more than it does on a general app. If a platform does not offer MFA, treat that as a real gap in cloud accounting security rather than a minor omission on a feature list.
Your accounting file is a map of your business: bank accounts, revenue, suppliers, payroll, and tax records in one place.
That concentration is exactly what makes it valuable, and it is why access control matters as much as encryption. A shared login passed between three people removes any way to tell who did what — and when a figure needs explaining later, nobody can trace it back.
Most cloud platforms avoid this by giving each user their own credentials and letting you assign roles. That structure is the point, not a formality, and it is the first thing to look for in multi-user accounting software.
Giving your accountant access properly
Accountants and bookkeepers need to work in your file, and the right way to do that is through their own user account with appropriate permissions, not your password. Most cloud accounting platforms support this directly, and many accountants work across multiple client files this way.
Before you choose, ask whether your accountant needs a separate subscription, whether they can reach your file from their own practice account, and how quickly you can revoke access if the relationship ends.
Roles and permissions for teams
If you have staff who raise invoices, enter expenses, or process payroll, you do not want them seeing everything. Role-based permissions let you scope access to what the job actually needs. Granularity varies by platform, so check it before you commit rather than after.
-
Billing clerk
Enters supplier bills and expenses. No visibility of payroll, and no access to the general ledger.
-
Sales staff
Raises customer invoices and checks who has paid. Does not need the full chart of accounts.
-
Payroll officer
Runs payroll and keeps employee records current, without editing revenue or supplier entries.
-
External accountant
Works across the file from their own account, with access you can widen at year-end and revoke when the engagement closes.
For growing Singapore SMEs, this is often the point where a lightweight tool stops being sufficient. If you expect to hire, or to bring in an accountant within a year, weigh multi-user access now — retrofitting permissions onto a file everyone has shared is messy.
Distributed teams and remote access
One file, many locations
Cloud accounting's advantage is that your books are reachable from anywhere, which is also why access control has to be deliberate.
Part-time finance staff
Businesses with part-time finance staff or external bookkeepers feel this most, because those relationships change and access needs to change with them.
Not optional extras
MFA, individual logins, and clear permissions are the working parts of a remote setup, not add-ons you get to later.
What to check before you commit
Ask each vendor four questions, then check the operational side of how the platform is actually run day to day. A platform that answers all of these clearly is one you can hand your books to with some confidence.
Question one
Does it support MFA?
Confirm it is available on your plan and not held back for a higher tier. Ask what second factors are accepted, so the answer fits the phones your team actually carries.
Question two
Can you assign roles and permissions?
Check how fine the settings go: whether a person can be limited to billing only, or blocked from payroll and the general ledger entirely.
Question three
Can your accountant use their own account?
Ask whether they need a separate subscription and whether they can reach your file from their practice account without your login details.
Question four
What is the process for removing a user?
You want this done in a few clicks by an owner-level user, without a support ticket. Ask the same about lost devices and how a session is ended.
Then the operational side
How are bank feed connections authorised, and who can reconnect one? Can you see an access log of who signed in and what they changed? What happens if a device is lost or a staff member leaves without handing over their phone? These answers separate a platform that takes cloud accounting security seriously from one that only lists the feature.
Data handling and record retention
Beyond access, you want to know where your data sits and how you get it out. Cloud platforms store your records remotely, and the practical questions are whether you can export your data, what format it comes in, and how long records are retained.
Before you migrate
-
Confirm the export path first
Check what you can export, in what format, and whether reports come out complete. Leaving a platform is easier when you planned for it.
-
Match retention to your filing
For GST-registered businesses, audit-ready records are part of the filing environment IRAS operates in. Ask how long records are kept and whether you can retrieve older periods.
-
Know where the data sits
Records live on the vendor's infrastructure, so ask where they are stored, who at the vendor can reach them, and how deletion is handled when you close the account.
Matching security to your business size
A sole trader with one login has simpler needs than a firm with ten staff and an external accountant, and that is fine. The mistake is assuming you will grow into proper access control later. If you expect to hire, or to bring in an accountant within a year, weigh multi-user access and MFA now — it is cheaper than switching platforms for it.
Questions Singapore businesses ask about access
Is MFA standard in cloud accounting software?
It is widely available and increasingly expected. Xero's Singapore pages highlight secure MFA for cloud access, and most mainstream platforms offer it. If a platform you are considering does not, treat that as a serious limitation for financial data.
Can my accountant log into my accounting file?
In most cloud platforms, yes. Your accountant typically uses their own account with permissions you grant, rather than sharing your login. Ask whether they need a separate subscription and how access is revoked when the engagement ends.
What happens to my data if I switch platforms?
It depends on the export options the platform provides. Most allow you to export transactions, contacts, and reports, but formats and completeness vary. Check export options before you migrate so leaving later is not a problem.
How many users can access one cloud accounting file?
It varies by platform and pricing tier. Some include a set number of users, others charge per user. Check the tier that matches your team size, including any external accountant or bookkeeper who needs access.
Set access up before the file gets busy
Lythamor Cloud Accounting is registered in Singapore and supports businesses through setup, migration, and day-to-day use of cloud accounting software, including access and permission configuration for teams and external accountants.
Talk to us
- 71 Robinson Road, #04-01, Singapore 068895
- +65 6256 2293
- [email protected]
- Monday to Friday, 9:00 AM – 6:00 PM (SGT)
Send a message through the contact page and we will follow up with setup guidance for your team size.