Getting Portal das Finanças access for my company, and the first things I did with it

The letter never came.

Descodify LDA was registered on the 15th of May. With registration comes a senha for the Portal das Finanças, the password that is your company's key to everything tax related in Portugal. The AT sends it by registered post to the company's official address. So I waited.

After a couple of weeks of nothing, I went to the tax office in Lagos to ask where it was. The two people there were friendly, helpful, and understanding, and it was clearly a problem they already knew about. When I told them the letter hadn't arrived, they pulled out a tray of returned mail and started flipping through it. Not a handful of envelopes. Somewhere between fifty and a hundred letters, all sent by the AT, all bounced back undelivered.

Mine wasn't in the pile. They told me the address was correct, that the post simply isn't being delivered reliably at the moment, and that I should wait another fifteen days.

Then it clicked. I live almost exactly on the line between two municipalities, Lagos and Vila do Bispo. If Lagos had a tray of a hundred returned AT letters, my local office in Vila do Bispo probably had its own. So I drove over. They had a pile too. Mine was in it. Five minutes, an ID check, and the letter was finally in my hand.

There was one more thing to sweat. Three days earlier, tired of waiting, I had emailed [email protected] to cancel the senha they had sent so I could start the process over. If they had already processed that request, the password now in my hand would be dead. They hadn't gotten to it. The senha worked.

That is how I got access to my own company. Not a click. A small bureaucratic manhunt across two tax offices, racing an email I had sent to cancel the very thing I was collecting.

Getting in was the hard part. Using it well is the part that actually matters. Here is what I did in the first week.

First: set your own senha

The senha arrives in a sealed, tamper evident envelope, the kind where the seal shows if anyone has opened it. When I collected mine, the clerk checked the seal was intact before handing it over. The AT clearly treats this password as something worth protecting in transit, which is a good hint for how to treat it once it's in your hands.

The portal does not force this on you, so do it yourself: go into your access details and replace the mailed senha with one of your own. The one in the envelope was generated for you, not by you, and you want a password only you have ever seen, kept somewhere only you can reach. Set it deliberately, not as a throwaway you'll forget by next week.

To change it again later, the path is Dados de Acesso (under Serviços, Autenticação de Contribuintes). Mind the label: it is Dados de Acesso, not "Os Seus Dados," which is what half the older guides online still send you looking for. The password needs at least eight characters with an uppercase, a lowercase, a number, and a symbol.

A few minutes of work. Do it before anything else, because everything else on this list assumes the only person who can log in as your company is you.

The two-factor login you can't switch on yet

Here is where I, building a Portuguese tax product, walked straight into a wall.

The Portal das Finanças finally has proper two factor authentication, a real second step, an SMS code on top of your password. I went to turn it on for the company and found that I can't. It works on personal NIF logins, mine included, even with self employed activity behind it, but not on a corporate login. Companies like mine are a later phase that hasn't arrived. So the company login, the one with access to everything, is still guarded by a password alone.

You might assume Chave Móvel Digital, the government's mobile login, fills the gap. It doesn't, at least not yet. My gerente role is already tied to my CMD, you sign as gerente with the CMD during the company's online incorporation, so I expected it to let me sign in as the company. The AT portal still won't take it for a corporate login. No second factor, no CMD shortcut. On a company account the password is the whole story.

So the hygiene is the defense, all of it. Start with a password you don't reuse anywhere else.

Then register your email and phone number in the portal, under your contact details. This caught me out. I had entered both when the company was formed, but that information sat with the company registry (the IRN), not the tax office, and the two do not share it. The AT had neither. I had to add them again in the portal and verify each one, a code sent to the email and an SMS to the phone. Do it now, because those verified contacts are how the AT reaches you about the account, and in the next step they are how you find out a legal notification has landed.

That is everything you have on the security side, until two factor for companies finally lands.

Switch your notifications to electronic

Now the payoff to that opening story. I watched two separate piles of undelivered AT letters, fifty or more in each office. That is the system you are trusting when you let the AT reach you by post. Tax notifications are not birthday cards. Some of them start a clock you do not want to miss.

So turn the paper off. The portal has electronic notifications, NCEPF (Notificações e Citações Eletrónicas no Portal das Finanças). Once you activate it, official notifications and citations arrive as a PDF in your reserved area instead of an envelope that may or may not find your door. The path is Notificações e Citações, then Gerir canais, then Canais de Notificação, then Portal das Finanças, then Ativar.

For a company this is close to mandatory anyway. Businesses based in Portugal are required to be reachable through an electronic channel, and activating the portal's own channel satisfies that and replaces the old ViaCTT mailbox. You are not taking on a new obligation, you are choosing the version of it that doesn't depend on the post.

It is better than paper in another way. When a new notification lands, the AT emails your registered address to tell you it is waiting, so you are not expected to log in every day on the off chance. The one catch is that the clock does not wait for you to read it. A notification counts as delivered on the fifth day after it appears, whether or not you opened the email or the notification itself. So keep the email on your account current and actually watched. Done right, this beats the post outright: a folder you control, with a nudge when something arrives, instead of an envelope that has to find your door.

Check Segurança Social, and don't pay it twice

Here the company side is genuinely automatic. When you incorporate, your company is enrolled with Segurança Social and given its own number (NISS) without you asking. That part you can trust.

What is not automatic is access, and one declaration, and both fall on you. First you need the company's Social Security number, the NISS, which is not the same as its tax number (NIPC) and is not printed on your registry certificate or your tax paperwork, so you may have to ask Segurança Social for it directly. Segurança Social does not mail you a password the way Finanças does. You set up your own access to Segurança Social Direta, ask for a verification code, and choose your own senha, and the company has its own login separate from your personal one. That is why signing in with your personal Chave Móvel Digital may not show the company at all. I hit exactly that, and had to set the company up on its own.

Then the declaration with a clock on it. You have ten business days from taking up the gerente role to declare yourself as a company officer (membro de órgão estatutário) to Segurança Social. Miss the window and they register you anyway, on their terms, at a base of one IAS, which means they start charging you whether or not you meant to pay.

That declaration is also where the money is. If you already pay Social Security through a freelance activity, as I do, you shouldn't have to pay a second time just because you are now also a gerente. Social Security's own rulebook (the Código Contributivo) has a rule for exactly this. Declare no salary as gerente and keep your freelance income above one IAS (Portugal's social-support index, 537.13 euros a month in 2026), and your gerente contribution can be waived completely. Draw a gerente salary and you lose the full waiver, but you pay only on what you actually take instead of on an artificial minimum.

None of that waiver is automatic either. There is no button in Segurança Social Direta that says "I already pay, exempt me." It is declared, with your no-salary decision written into a formal resolution (ata), and in practice your accountant files it alongside the gerente declaration itself. Skip it and the default is roughly 186 euros a month in contributions you never owed.

These rules also change more often than they should, so confirm the current conditions with your accountant before you lean on them. But do confirm them, because this is the clearest case in the whole list of money you only keep if you are paying attention to your own affairs.

The password question, and the people who never look

Whoever holds your senha is, in practice, running your tax life. And handing it over is the default here, far more than people admit.

It is how a lot of people deal with their personal IRS. You arrive, you find a "consultant," you give them your AT password, and you look away until next year. I have watched it happen, and a version of it happened to me: I gave someone access, the password was changed at some point without a word, and I had to ask for the login to get back into my own account. The company version is the same arrangement with higher stakes. Hand the accountant the key, close your eyes, hope for the best.

None of that changes the one fact that matters. You are responsible for what is submitted in your name. Not the consultant, not the accountant. You. If a number is wrong, if a declaration is late, if something is invented, it is your name on the filing and your problem to clean up. I learned that the slow way and wrote about it separately, what it is like to hand your portal login to an accountant and slowly realize you cannot see what is being filed.

You don't have to ask around long to hear the other version of this. Someone opens a company, hands the whole thing to a "consultant," and assumes that no activity means nothing to do. It doesn't. A company registered for VAT files a return every quarter, even a quarter where it sold nothing. A nil return is still a required return, and missing it is still a fine.

And not filing doesn't leave you at zero. When a return is missing, the AT issues its own assessment of the VAT it presumes you owe, based on whatever information it has, and it carries a legal minimum that is never zero. Silence does not read as nothing sold. It reads as a blank the AT fills in for you. Two years of missed returns can turn a company that never traded into a five figure bill: part fines, the rest tax assessed only because the declarations that would have shown a real zero never arrived.

Most of that assessed tax comes off if you file the missing returns in time. The fines stay. Either way it is months of cleanup and a real scare for a company that did nothing but exist.

So, the password itself. Do you hand your company's login and senha to your accountant? No. And the reassuring part is that a good one doesn't need it.

A contabilista certificado already has their own way in. Once they are registered as your company's accountant, they reach your filings through their own professional login, authenticating as themselves, not as you. That is the proper route, and it is the one that leaves a clear record of who did what. Your master password was never part of the deal.

When they need something more specific, there is a second tool. Say their software pulls your issued invoices to reconcile the accounts. For that you create a sub user in the AT portal, under Gestão de Utilizadores, with exactly the permissions that one job needs and nothing else. Their system connects as that limited user, on its own credentials, while your master login stays yours alone.

Segurança Social works the same way now. It has its own sub-accounts, under "Gestão de acessos", so your accountant gets scoped access there too, on their own credentials, never your senha.

So when an accountant asks for your senha, you don't need an argument. You have a better offer: use your own access, and I will set up a sub user for whatever your software needs to pull. A current accountant recognizes both at once, because the Ordem dos Contabilistas publishes the guide for exactly this. One who insists on your password is telling you they work the old way, and the old way is how people end up not knowing what was filed in their name.

If your contract isn't signed yet, this is the moment to put it in writing. Mine isn't, which is why it is the conversation I am having right now.

What it all comes down to

So the whole thing comes down to one rule, and it is not complicated.

Don't outsource your tax and your finances and then look away. Don't give anyone the keys to your company without a way to see what they do with them. Just don't. It is the sort of mistake you regret exactly once, because once is enough.

That is not an argument against help. Find someone you trust. A good accountant earns their fee, and there is plenty I would rather pay someone else to handle. But keep your own keys. Work in a setup where you can see every filing that goes out in your name, and learn enough to actually read it. If you run a simple freelance activity, you can probably file most of it yourself. If you run a company, your accountant signs the accounts, but nothing stops you understanding every number before it goes out.

Doing it yourself is only realistic if the doing is simple. That is the part I have spent the last while building. Descodify prepares your certified invoices, your VAT, and your Social Security, and shows you every figure before you file it. You still do the filing, which is the point. You stay the person who knows what went out under your name. It won't run a company's full accounts, that still needs a contabilista, but for a solo activity it handles the work that used to be the reason people gave their password away in the first place.

You went through real trouble to get access to your own company. Don't hand it back.