Keeping the account safe

Two-factor authentication, roles, and who can do what.

Settings → Security. Scan the key with any authenticator app — Google

Authenticator, 1Password, Authy — then enter the six-digit code it shows.

Nothing changes until that code is verified, so an abandoned setup cannot

lock you out.

You are given eight recovery codes once. Save them somewhere that is not

the phone holding the authenticator. Each works once, and using one at

sign-in spends it.

Turning 2FA off needs your password, not just a signed-in session.

Settings → Users. A role is a set of permissions, and every action in the

product checks one — orders:void, settings:configure, reports:view.

Give a cashier what a cashier needs; manager approval covers the rest.

Reports → Operations → Activity log records every create, update and delete

with the user, the time and the IP. It is admin-only, because it carries the

shape of every change made to the business.