Giving Your Accountant a Way In

There are two routes an accountant can take into your Kantivo books. They deliver identical access — the difference is whether your records cross our infrastructure to get there. This page states that difference plainly so you can pick with your eyes open.

Two routes, one destination

What actually differs

Whichever route you pick, your accountant works with the same figures and the same permissions. Only the path changes.

Standard

Flip one switch and you are finished — no software to download. Requests from your accountant reach your machine by way of our secure relay.

Your data crosses our servers in transit.

Direct (VPN)

An encrypted point-to-point link joining the two computers. Your books never pass through our servers.

Both sides need Tailscale installed first.

Standard — the one-switch route

Head to ⚙️ Company Settings → 👨‍💼 Accountant Access and enable Standard. Nothing else is required of you. Behind the scenes your copy of Kantivo reaches outward to our relay and keeps that channel open, which is precisely why no router rule, firewall exception, or VPN client is needed at either end.

Because the channel is opened from the inside out, it behaves the same on home broadband, a corporate network, or a tethered phone.

Inviting your accountant hands you a short code — 4KP2-9WTD, or something much like it. They install Kantivo, open Accountant Access, key it in, and the connection stands up. Characters that get confused when read aloud or copied badly — O against 0, and I, L against 1 — are absent from the alphabet altogether, so the code survives being dictated over the phone.

The invitation names the route. With Standard switched on, the email your accountant receives tells them there is nothing for them to configure. Where Standard is unavailable, that same email says so and hands them the Tailscale instructions instead. What nobody gets is a promise of a one-click connection followed by a request to install a VPN.

Where the honesty matters. Under Standard, your bookkeeping records travel across our relay infrastructure on their way to your accountant. Nothing is retained and nothing is ever written into a log file — but the traffic does touch equipment we operate. Where that is unacceptable for the kind of records you hold, take the Direct route. We would rather be blunt about this than let you infer a guarantee we are not making.

Direct (VPN) — the private route

Direct wires an encrypted tunnel from your accountant’s computer to yours by way of Tailscale, with no intermediary. General ledger, invoices, payroll history, client documents — all of it moves machine to machine and at no stage crosses anything belonging to us.

What it asks in return is a little configuration: each of you installs Tailscale under your own account, then you grant your accountant access to your device. The Tailscale setup guide lists every screen and link you will need.

Deciding between them

Take Direct when your profession requires it of you. Practices handling privileged legal files, patient records, or public-sector accounts are often bound by rules under which a supplier touching the data at all is disqualifying — not a matter of taste. If anyone is ever going to audit how your books move between machines, Direct gives you a clean answer.

Take Standard when no such rule applies and your time is the scarce resource. For a trades business, a cafe, or a small agency, one switch replaces an afternoon of network configuration across two offices.

Nothing here is permanent. Standard can be switched back off whenever you like, and adding Direct later leaves both routes available. Changing route touches neither your records nor your accountant’s existing permission.

Reviewing and cutting off access

That same settings panel shows every person currently able to open your books, the date access began, and the last time they used it — each with a Remove access control.

Removal bites on the next request they make. There is no grace period and nothing to wait for, and it works identically on both routes: Direct offers no slower an exit than Standard does.

When the machine is powered down

Be clear that neither route is cloud hosting. Kantivo executes on your computer and your books reside there. A workstation shut down on Friday night is unreachable on Sunday morning regardless of which route you chose.

Where an accountant genuinely needs access beyond your working hours, the answer is to leave that machine powered on with Kantivo running. On their side the client list reads “their computer is off” rather than throwing an error, so the situation explains itself.