Team & security
Hand over the keys, one door at a time
Give your packer the orders, your designer the storefront and your accountant the reports — and nothing else. Two-step login keeps every account safe, and the activity log shows who did what.
- Area-by-area permissions
- Two-step login
- Store activity log
Availability: Every plan — 2 staff accounts on Basic, 10 on Pro, 50 on Advanced
Roles
Three roles, with exactly the access they need
Owner
Everything, including billing and handing the store to someone else. There's one owner per store.
Admin
Everything except billing and transferring ownership — and admins can manage the team.
Staff
Only the areas you tick: Orders, Products, Customers, Discounts, Storefront, Media, Settings, Reports & analytics, Marketing & email, Point of Sale, Bookings, Developers or Apps.
Invitations that expire
Invite by email with the role already chosen. Invitations last 7 days and hold a seat until they're accepted, cancelled or expire.
Everyone sees home
Staff without an area still see the home page, with a note to ask the owner for more access.
Two-step login
A stolen password isn't enough
Anyone on the team can turn on two-step login with an authenticator app such as Google Authenticator, 1Password or Authy: scan a QR code, enter the 6-digit code, and save a set of one-time backup codes. The owner can then require it for everyone who works in the store.
- Backup codes shown once, with copy and download, and can be regenerated
- "Where you're signed in" lists every device, with sign-out for any of them
- Recent sign-ins show the last 10 logins, and an email arrives when a new device signs in
- Changing your password signs out every other device
Everything in detail
People, access and accountability
28capabilities in 5 areas
Staff & invitations
6- Invite by email as Admin or Staff
- Choose areas for each staff member, and change them later
- Resend or cancel pending invitations
- Remove people, or let staff leave a store themselves
- Hand over ownership to another member
- Staff limit per plan: 2 on Basic, 10 on Pro, 50 on Advanced
Permission areas
8- Orders, Products, Customers and Discounts
- Storefront and Media
- Settings, with each settings tab shown only to people who can use it
- Reports & analytics
- Marketing & email
- Point of Sale and Bookings
- Developers (API & webhooks) and Apps
- Billing is only ever for the owner
Account security
6- Two-step login with any TOTP authenticator app
- One-time backup codes, used up once accepted
- Store-wide "Require two-step login for everyone", set by the owner
- Signed-in devices list with remote sign-out
- Last 10 sign-ins and new-device emails
- Email change confirmed by a link to the new address
Activity log
4- Who changed what across products, orders, settings, the team and more — newest first
- Filter by person and by type of change
- Actions with no person attached are shown as System
- Changes made during a support session are labelled "via SellOrchard support"
Support sessions
4- When SellOrchard support needs to see your admin, the session is time-limited
- A banner stays on screen for the whole session, showing who opened it and when it ends
- The session can be ended from the banner at any time
- Every support session is recorded in SellOrchard's internal audit log
At a glance
- roles: Owner, Admin and Staff
- 3
- permission areas to choose from
- 13
- before an unused invitation expires
- 7 days
- staff accounts on Advanced
- 50
Store health keeps an eye on it
Your store's health check flags owners and admins who haven't turned on two-step login, so a weak spot doesn't go unnoticed.
How many staff accounts do I get?
2 on Basic, 10 on Pro and 50 on Advanced. Pending invitations hold a seat until they're accepted, cancelled or expire after 7 days. The free trial includes 1 staff account.
Can I limit what a staff member sees?
Yes. Give them the Staff role and tick only the areas they need — for example Orders and Customers. Everything else is hidden from them, and billing is always owner-only.
What's the difference between Admin and Owner?
Admins can do everything, including managing the team, except billing and handing over the store. Only the owner can do those, and only the owner can require two-step login for the store.
Which authenticator apps work with two-step login?
Any app that generates standard 6-digit time-based codes, such as Google Authenticator, 1Password or Authy. You also get one-time backup codes in case you lose your phone.
Can I see what my team has changed?
Yes. Settings → Activity lists who changed what, newest first, with filters for each person and type of change.
Can SellOrchard support access my store?
Only through a time-limited support session. While it's open a banner shows who started it and when it ends, it can be ended at any time, and changes made during it are labelled in your activity log.
Bring your team in safely
Invite your first staff member, choose their areas and switch on two-step login in a couple of minutes.
No credit card needed to start.