Guides / Your store

Team, roles and security

By the end you will know what each role can do, how two-factor and the extra code for money actions work, and where to read the audit log.

Everyone who works in your store has a role. The role decides which pages they see and what they can change. The sidebar only shows a person the pages their role allows.

See your team

Open Team, under Admin in the sidebar. The table lists each person's Name, Email, Role, Status and Two-factor, which says On or Off. The Team page is for reading. You cannot add or change people from it.

What each role can do

• owner: everything, including Billing.
• admin: everything except Billing.
• catalog: products, prices, supplier cost and content. They can publish products.
• sales: orders, quotes, customers and company accounts. They can send quotes and see customer contact details. They see prices but not supplier cost.
• fulfillment: orders, shipping and customer contact details. They cannot change prices or take payments.
• finance: refunds, recording payments received, supplier cost, and the Audit log. They cannot change products.
• read-only: view products, prices, orders, quotes, customers, companies and Team. They cannot change anything.

Only owners and admins can change Storefront, Domains and Integrations, and only an owner can open Billing.

Two-factor sign-in

Open Account security to set up two-factor with an authenticator app. You confirm your password first, scan a code, save your backup codes and enter the first code from the app. Once it is on, the page says each sign-in asks for a code.

On the live service, two-factor is required for everyone who works in a store. Without it, you are sent to Account security instead of the console.

The extra code for money and key actions

Some actions ask for a fresh code from your authenticator app, even when you are already signed in. A field called Your two-factor code (asked before money and key changes) appears in the form. Type the 6-digit code and submit as usual.

• Refunding an order and recording a payment received.
• Connecting Stripe and saving bank transfer settings.
• Subscribing, and opening Manage billing.
• Adding or replacing the Freightcom key, and disconnecting it.
• Changing a company's commercial terms, or putting its credit on hold.

A code you enter counts for the next 10 minutes. After that, the field comes back. Five wrong codes in 15 minutes lock the check, and you must wait 15 minutes before trying again.

Read the audit log

Open Audit log, under Admin. Owners, admins and finance staff can see it. It lists the latest 200 events, newest first. Each row shows When (UTC), Action, Target and Details. Staff cannot edit or delete entries.

Checked against the product on November 14, 2026.