Why this matters
Access to inboxes and portals powers invoice collection. The question is how to grant that access without creating new risks. For SMBs, this usually comes down to two choices: use a Chrome extension or share a password. The difference in security is real.
Option 1: Using a Chrome extension
A browser extension requests specific permissions to act while you are signed in. It relies on session cookies and scoped APIs, not on storing your password. It inherits your MFA, device rules and provider security. Access can be removed by disabling the extension or revoking tokens.
Benefits:
- Least‑privilege by design
- No password storage
- Works with MFA and SSO
- Easy to revoke and audit
Option 2: Sharing your password
Sharing a password looks simple but increases risk and cost. You lose control of where credentials live, who copies them, and how they are used. MFA is often weakened to make sharing work. Audit trails break because many actions appear as the same user.
Risks:
- Credential reuse and phishing
- MFA bypass or removal
- No clear user‑level audit
- Policy and compliance issues
Security comparison
- Control: extensions can be disabled or uninstalled at any time; shared passwords spread and persist
- Scope: extensions request narrow capabilities; passwords grant full account access
- MFA: extensions respect existing MFA; shared passwords push teams to weaken MFA
- Audit: extensions operate under your user with logs; shared passwords blur responsibility
- Revocation: extensions revoke with a click; passwords require resets across tools
What SMBs should do
Prefer extensions and OAuth‑based access. Keep permissions minimal, enable MFA, and use per‑user accounts. Avoid sending passwords over chat or email. If a vendor requires passwords, isolate that account, set unique credentials, and rotate often.
How Numerand approaches access
Numerand uses extensions and secure sessions to collect invoices from email, Drive and supplier portals without storing passwords. Access is scoped, revocable and observable. You keep control, and we keep your data in the systems you already use.
Closing
Security is not about more tools, but about safer defaults. For SMBs, extensions beat shared passwords on control, scope, MFA and audit. Choose the option that reduces risk while keeping your operations simple.