AccessPath for Firms

Your office runs on logins.
Can you say who has them?

People leave. Their logins don't.

Take the tour

The problem · 1 of 3

Nobody knows who has two-factor.

Drake, IRS e-Services, the client portal, email. Six people, dozens of logins, and no list.

The problem · 2 of 3

People leave. Their logins keep working.

Seasonal staff come and go every April. Their passwords, phones and reset emails stay behind.

The problem · 3 of 3

The FTC wants proof, not a promise.

Tax preparers count as financial institutions. Multi-factor applies to everyone on every system, at any size.

Staff × work systems

Every person. Every system. One screen.

For every cell, see the two-factor method, whose phone holds the code, and where the proof came from.

The first fix

Know what to fix first, and what it's worth.

$168,000 at stake on one login: 875 client records × $192 (IBM, 2026).

Ranked by rule: no two-factor first, then by records at stake. Never added up: it's the same clients.

Jake’s iPhone vault

Staff turn it on. You see it happen.

Jake turns on two-factor for Drake. His encrypted vault reports the system, where the code is kept, and the date.

Stays on the phone

Password
Username
Two-factor code

Highest remaining fix

$168,000 $84,000

Jake’s Drake login leaves the top three. The owner sees “code in this vault,” dated and labeled as Jake’s own report, not as verified.

Tom’s last day

Someone leaves. Every password they could reach, in one list.

Tom left April 15. His checklist shows which logins need a password change, who owns each change, and what’s still open.

IRS e-Services

It also blocks the shares the IRS forbids.

When a preparer tries to share an IRS login, the app stops the share and explains why.

IRS Pub 4557 and Pub 3112

The evidence pack

Proof, ready to hand over.

16 CFR 314.4(c)(5): multi-factor for anyone on any system. No small-firm exemption. AccessPath helps you prove it.

Export a dated record of each system, its two-factor method, and the evidence behind it.

For small tax offices

AccessPath for Firms.

See who can get into what. Prove two-factor. Fix it when someone leaves.

Owner login How it works

$49 a month per office, unlimited seasonal staff (a price we're still testing).

How it works

Two apps. One answer for the owner.

1
The owner maps the office

Staff and the systems they use: Drake, IRS e-Services, the client portal, email, the refund portal, TNTAP. Each person gets a link to join from their phone.
2
Staff keep their own vault

Work logins and two-factor codes live in an encrypted vault on each person's iPhone. AccessPath knows which IRS logins can never be shared.
3
Status fills the grid

The vault reports only status. The owner sees every person on every system, fixes gaps in order, and exports a dated evidence pack.

The numbers

What each system puts at stake.

Client records the system can reach, times $192 per record (IBM Cost of a Data Breach, 2026). Shown per system and never added up: every system draws on the same 875 clients, so the worst case for the whole office is $168,000.

~63,000: non-chain, multi-preparer US tax offices (IRS PTIN file)
$49/mo: per office, unlimited seasonal staff. A price we're still testing with owners.
314.4(c)(5): FTC Safeguards Rule: multi-factor for anyone on any system

Maple Street Tax Co. (demo) · 875 client records

Drake$168,000
IRS e-Services$168,000
Client portal$117,600
Email$84,000
Refund portal$50,400
TNTAP$50,400

Optional view in the dashboard: estimated yearly risk, $17,277 at a 2.4% base rate ($4,386 to $41,884 across 0.6% to 6%). A model, not a prediction.

The staff app

A vault on each person's iPhone.

Items are encrypted on the phone before they leave it (libsodium XChaCha20-Poly1305, with Argon2id for the key). The Office tab shows the systems the office uses and one thing to do for each.

Sent to the office

Which system
Where the code is kept
Whether one is saved
The date

Never sent

Passwords
Usernames
Two-factor secrets and codes
Notes

The iPhone app isn't on the App Store. It runs on Dev's iPhone at our table. Ask to try it.

How it's built

We decide. AI builds. We check.

Claude Code wrote most of the code

The iPhone app, the vault server and its web app were written with Claude Code (Anthropic) from our written brief. We review each change and run the tests.

AI agents built the dashboard

Kevin's AI agents built the owner dashboard and the research behind the numbers. Every figure links to a public source, and audit passes removed the claims we couldn't back.

People made the calls

Dev and Kevin chose the problem, set the security rules, made every spending decision, and tested on real iPhones.

No AI in the vault

Nothing in a staff vault is sent to an AI. The dashboard's setup interview has an AI path built, but for the demo it runs on pre-written answers.

This page

OpenAI ImageGen made the office and device pictures. Codex and Claude Code helped build the scroll story in HTML, CSS and JavaScript. The laptop uses product screenshots. The phone recreates the Office tab with demo data.

Where it runs

Vault server: Node and SQLite on Dev's Mac, behind Cloudflare at app.getaccesspath.com (about $10 a year for the domain). Dashboard: Vercel and Supabase free plans. Not production hosting.

Real vs. demo

What you can trust today.

Real

The staff vault and its encryption
The owner dashboard
The phone-to-dashboard status link
IRS no-share rules (Pub 4557, Pub 3112)
Sources: IBM 2026, IRS PTIN file, 16 CFR 314

Demo

Maple Street Tax Co., its staff and 875 clients
The setup interview's answers
The Microsoft 365 check (built, no tenant connected)
The phone on this page, a browser copy of the app
No outside security review yet

Try it at our table.

The laptop is the owner's. The phone is Jake's.

Owner login

Your office runs on logins.Can you say who has them?