How borrower magic links work (no logins, ever)

Borrowers never create accounts. Each person on a file gets a unique, unguessable link — that link IS their key.

• Scoped: a guarantor's link shows only the guarantor's items; the CPA sees only theirs.
• Rolling expiry: links stay alive as long as they're being used (30-day rolling window). Every reminder or invite email carries a fresh link automatically.
• Revocable: on the file page, under People & magic links, you can revoke a link instantly ("New link to copy" restores access).
• Optional email verification: Settings → branding → "Extra verification" adds a 6-digit email code step for firms that want it.

Security note: we store only a cryptographic fingerprint of each link, never the link itself — so even a database breach couldn't forge borrower access. If a borrower says their link "stopped working," just click "New link to copy" or resend the invite; a fresh link takes effect immediately and the old one dies.