Help
EmaraTax and accounting-software credentials, and why they are handled differently from everything else.
Portal credentials do not live in the client record with everything else. They sit in a separate table with its own rule: only roles that may write — owner, admin, manager, accountant — can read it at all.
A read-only advisor's browser never receives them. They are not masked with CSS or hidden behind a button; they are never sent. Nothing to find in the console, nothing in the page source.
Open the client → the Corporate Tax or VAT tab → Edit → the portal username and password fields. Save. A database trigger strips the password out of the client record itself on every save, so it cannot leak into the general data by accident.
It shows as dots with a reveal and a copy button. Copying does not display it. The activity log records that a password changed — it never records the value, so nobody can reconstruct a password from the audit trail.
If people share a screen, set a PIN from the Team page and use Lock. The desk re-locks by itself after a period of no activity, and a PIN is needed to get back in. Signing out entirely is heavier than most firms want twenty times a day.
Storing a client's FTA password is normal in UAE practice and the desk supports it properly. It is still worth agreeing with each client in writing that you hold it, and reviewing who at your firm needs write access — because write access is what grants sight of the passwords.