Set up Google sign-in for your firm
Coming This guide describes Tallycon accounts, which open with our hosted service. Until then it is a preview.
What it does
Your people can sign in to Tallycon with their Google Workspace work account instead of a code sent by email.
When someone leaves, suspending their Google account stops new Google sign-ins, but computers they are already signed in on stay signed in. Also disable them in Tallycon (console, Users, Disable): that cuts them off at once, on every computer, and frees their seat.
It works only for people a partner has invited. Google sign-in does not create Tallycon users: a Google account gets in only if its address is one a partner of your firm invited.
Before you start
- You are a partner in your firm's Tallycon account. Only partners change sign-in settings.
- Your firm uses Google Workspace (work addresses like
asha@demo-ca.example). Personal Gmail accounts cannot use Google sign-in; they sign in with an email code. - Each person's Tallycon invite is for the same address Google reports as their primary address. An alias does not match. If Ravi was invited as
ravi.k@demo-ca.examplebut his Google account isravi@demo-ca.example, inviteravi@demo-ca.example.
Step 1: Add your Google domain
In the web console, open Sign-in and SSO and add your firm's Workspace domain, such as demo-ca.example. You can add up to 10 domains if your firm uses more than one (demo-ca.example and demo-ca.in).
You do not have to prove you own the domain. A Google account still reaches only a person your firm invited by that exact address, so listing a domain gives nobody new a way in.
Every partner gets an email whenever the domains or the Google setting change.
Step 2: Sign in with Google
In Tallycon, open Settings and choose Sign in with Google. Tallycon opens your usual web browser (never a window inside the app), Google asks you to pick your work account, and the browser then says you can close the tab and return to Tallycon. You are signed in.
The first time someone signs in with Google, Tallycon remembers that Google account for their address. If your Workspace admin later gives the same address to someone else, that new account is refused until a partner clears the old link (see "When something goes wrong").
Anyone can still sign in with an email code, unless you turn on Step 3.
Step 3 (optional): Require Google sign-in
Under Sign-in and SSO, tick Staff and owners must sign in with Google and save. From then on:
- Staff and owners must sign in with Google. If they ask for an email code, they get an email saying "Your firm signs in with Google" instead of a code.
- Anyone on staff or an owner who is signed in with an email code is signed out and asked to sign in again with Google.
- Partners can still use an email code. This is the break-glass: if Google is down, or your Workspace is misconfigured, a partner can still get into the firm's account and fix it.
You need at least one Google domain listed before you can turn this on.
The break-glass, and why every partner is told
Because partners keep the email-code route, someone who got into a partner's mailbox could sign in without your Workspace's two-step verification. To make that visible, while Google sign-in is required, every partner sign-in by email code (in the app or the console) sends an email to all partners saying which partner signed in, where (app or console) and when.
If you get one of these and it was not a colleague, disable that partner in the console and contact us.
When something goes wrong
| What the person sees in Tallycon | What it means | What to do |
|---|---|---|
| "This Google account is not a Tallycon user of a firm that signs in with Google." | The address was not invited, or its domain is not in your firm's list | Invite the address Google reports, or add the domain |
| "That is a personal Google account." | A personal Gmail account was picked | Choose the work account, or sign in with an email code |
| "Google has not verified this address yet." | Google reports the address as unverified | Fix it in Google Workspace, or use an email code |
| "This address now belongs to a different Google account." | Your Workspace admin gave the address to a new account | A partner opens Users in the console and chooses Clear Google for that person; devices signed in with the old Google account are signed out, and the next Google sign-in links the new one |
| "Your firm has not set up sign-in with Google." | No domain is listed | Add the domain (Step 1) |
| "The Google page was open for more than 10 minutes" or "did not finish in time" | The sign-in took too long, or was finished in a different browser | Start again from Tallycon |
| "Tallycon could not open your web browser" | No default browser is set on the computer | Set one, or sign in with an email code |
Removing a domain signs out everyone in that domain who signed in with Google. They can sign in again with an email code, or with Google once the domain is listed again.
What Tallycon's server holds, and what it never sees
| Holds | Never sees or keeps |
|---|---|
| Your firm's Google domains and whether Google sign-in is required | Your Google password or two-step codes (you type them only on Google's page) |
| For each person, the Google account id linked to their address after their first Google sign-in | Any Google access or refresh token: the server reads Google's answer once to confirm who you are, then drops it |
| How each sign-in was made (Google or email code), kept with the sign-in itself | Your Gmail, Drive, contacts or calendar: Tallycon asks Google only for your email address |
| A short-lived record of a sign-in in progress, deleted when it completes, or otherwise removed by a daily clean-up | Your books, questions, answers, vouchers or client names |
The server never writes an email address, a Google account id or a Google token into its logs or into a web address.
Signing in with Google changes nothing about your books. Tallycon still reads Tally only on your office network and never writes to it, and conversations and question logs stay on your own computers.