Two-factor authentication
RevvFi's second factor is a time-based code from an authenticator app such as Google Authenticator, Authy or 1Password. There is no SMS option.
- Turn it on: Settings → Account → 2-step verification (or on the web, Settings → 2-step verification). Scan the QR code, or enter the key manually, then type the 6-digit code and tap Turn on.
- It is optional, except for the sensitive stuff. Exporting records from Reports, Deductions or Settings, and accepting an accountant link require 2-step verification and a fresh code. If you turned it on, a code is also asked before you connect or reconnect a bank. A verified code stays fresh for five minutes.
- Require it on every sign-in with the switch of that name under Settings → Security. Otherwise it is asked for only when you do something sensitive.
- Turn it off from the same Settings row (Turn off 2-step verification?). You will be asked to enroll again the next time you export or share with your CPA. Connecting a bank does not require it, but we recommend keeping it on.
Recovery codes
When you enroll, RevvFi shows ten one-time recovery codes in the form XXXXX-XXXXX. Copy them somewhere safe; each works once if you lose your authenticator. You can issue a fresh set with Regenerate in Settings → Account, which invalidates the old ones.
Face ID and fingerprint
Two separate switches under Settings → Security on the phone:
- Sign in with Face ID stores your password in the phone's secure keychain so biometrics can sign you in.
- Require Face ID to open RevvFi locks the app whenever it has been in the background for five minutes.
On Android the labels still say Face ID but use your phone's fingerprint or face unlock.
Passwords and reset
Tap Forgot password? on the sign-in screen and RevvFi emails a reset link. The reset page asks for a new password of at least 8 characters. Links expire; request a new one if you see This link has expired. If you signed up with Apple or Google and want a password too, use the same Forgot password flow. Passwords are hashed by Firebase Authentication; RevvFi never sees them in plain text.
What RevvFi never sees or stores
- Your bank login. Plaid shows your bank's own sign-in; RevvFi receives read-only transaction data and cannot move money.
- Card numbers for invoice payments. Stripe handles them, and payouts go to your bank without touching RevvFi.
- AI assistant tokens. Only hashed. See Agent Connect.
Data is stored in Firebase (Google Cloud) in U.S. data centers, encrypted at rest and in transit, with per-user access rules. AI features send the relevant data to Anthropic under agreements that prohibit training on it. The full detail is in the privacy policy.
Email us what you were trying to do and what you saw. A person reads every message.