Multi-User Best Practices

Security Policies:

Principle of Least Privilege:

• Give users minimum permissions needed for their job
• Front desk only needs Sale Only + Customer View
• Accountant only needs Reports Full Access
• Don’t give Master User by default

Regular Audits:

• Review user list quarterly
• Deactivate terminated employees immediately
• Review permissions – are they still appropriate?
• Remove unused accounts

Password Policies:

• Require strong passwords (8+ characters, mixed case, numbers, symbols)
• Force password changes every 90 days
• No password sharing (each person has own account)

IP Restrictions:

• Use for high-value accounts
• Use for accounts with refund capabilities
• Use for Control Panel access accounts

Two-Factor Authentication (2FA):

• If available, enable for all users
• Especially critical for:
  • Master Users
  • API key access
  • Remote access users

Workflows by Role:

Owner/Manager (Master User):

• Full access to everything
• Can configure all settings
• Reviews high-level reports
• Manages user accounts

Front Desk/Cashier:

• Process Transaction: Full Access
• Batches: View Only
• Reports: View Only
• Customers: Limited (only their customers)
• Everything else: No Access

Accountant:

• Reports: Full Access
• Batches: View Only
• Process Transaction: No Access (shouldn’t be processing)
• Control Panel: View Only (can see settings but not change)

Customer Service:

• Customers: Full Access (need to update info)
• Invoices: Full Access (need to send/resend)
• Reports: View transactions only
• Process Transaction: Sale Only or No Access
• Batches: Refund capability only

Salesperson:

• Customers: Limited (only their customers)
• Invoices: Limited (only their invoices)
• Reports: Limited (only their transactions)
• Recurring: Limited (only their subscriptions)
• Process Transaction: Full Access

Developer/IT:

• Control Panel: Full Access (needs API keys)
• Fraud Center: Full Access (configures security)
• Reports: Full Access (troubleshooting)
• Process Transaction: No Access (shouldn’t be processing)

Training:

• Create user accounts with exactly the permissions needed
• Train each user on their specific functions
• Don’t overwhelm front desk with features they’ll never use
• Tailored training increases efficiency and reduces errors