The /login chooser
/login is not a login form — it's a chooser. It shows three cards (Company owners, Shift staff, Assigned accountants), a language switcher (EN / PL / TR) and a Create-account CTA, then routes you to the right portal. We keep sign-ins separate by design: a staff member can't accidentally land on the company login and see a 401 they don't understand, and we don't leak the existence of an account type by showing a generic "wrong password" on a portal you're not enrolled in.
Every portal supports English, Polish and Turkish. The switcher sets the language for that session; you can also force a language from any URL by appending ?lang=en, ?lang=pl or ?lang=tr.
Company portal — owners and managers
Sign-in URL: /company/login. Authentication options:
- Email + password — the default, works for every workspace.
- Google SSO — if your business email is on Google Workspace, click Continue with Google instead of typing a password.
- TOTP second factor — optional, configured under Account → Security. When enabled, every fresh session asks for the 6-digit code from Google Authenticator / 1Password / any RFC 6238 client.
- Forgot password — link on the sign-in screen. We send a single-use reset link valid for 30 minutes. We always return a generic success message, even when the email isn't on file, so this surface can't be used to enumerate accounts.
What the company portal sees:
- Dashboard — KPI snapshot across brands, locations, revenue, expenses, targets.
- Operations — Shifts, Calendar, Edit hours, Locations, Employees, Leave / permission requests, Employee tickets.
- Finance (Pro) — Payroll, Employee wages, Expenses, Accounting, Invoices, Reports, Targets, Strategy.
- Bookings — operator calendar, services, professionals, customers, public-page settings.
- KSeF (Pro, PL) — outbound + inbound + audit log.
- AI Assistant (Pro) — at
/company/ai-assistant. - Integrations (Pro) — eleven connectors at
/integrations. - Settings + Subscription — at
/company/settingsand/company/subscription.
Inside the workspace, individual staff don't use this portal — only owners and managers you've flagged with company access. The number of company-side sign-ins is not limited by your plan; the number of staff sign-ins is.
Staff portal — everyone working a shift
Sign-in URL: /staff/login. Authentication is email + password. Staff accounts are created by a manager from the Employees screen — staff cannot self-serve sign-up. The welcome email contains a temporary password; the staff member changes it on first sign-in from /staff/panel/account.
What the staff portal sees, gated by the permission scopes a manager checks per employee:
- /staff/panel — staff home: today's shift, attendance code entry, earnings to date, pending requests.
- /staff/shifts — own assigned shifts (read- only — staff can see and confirm, but only managers can schedule).
- /staff/panel/responsibilities — task list for the current shift; outstanding items block check-out on the tablet.
- /staff/panel/requests — leave + permission requests submitted to managers.
- /staff/tickets — internal support tickets between staff and managers.
- /staff/shopping — accept and complete shopping requests; record receipts.
- /staff/invoices — read access to invoices the manager has granted permission for.
- /staff/locations, /staff/employees — directory views (no edit).
- /staff/docs — documentation tailored to staff workflows.
Staff sees their own wages on the staff portal — this is on purpose, payslip transparency. Accountants do not see wages.
Accountant portal — external bookkeepers
Sign-in URL: /accountant/login. Authentication is email + password. Accountant accounts are created by the GetUp team for assigned firms; you don't self-serve here either.
What the accountant portal sees:
- /accountant/invoices — invoice register for every company assigned to this accountant.
- /accountant/ksef-inbound — KSeF inbound metadata index, scoped to assignments.
- /accountant/ksef-outbound — KSeF outbound archive, scoped to assignments.
- /accountant/settings — account, language, password change.
What the accountant portal does not see, and never will via this surface:
- Payroll detail — gross hours, deductions, payment status.
- Employee records, contracts, wages or permission scopes.
- Companies the GetUp team hasn't explicitly assigned to this accountant.
- The KSeF connection itself — accountants can read what flows through it, but not edit credentials or environments.
Need a multi-firm accountant who handles ten of your client companies at once? Each company is added to their assignment list separately by the GetUp team — there is no self-serve company-add UI on the accountant side.