Published Last updated Written and reviewed by the Resale Intelligence team
On this page
Check everyone has only the access they need, look at findings such as missing 2FA or long inactivity, fix them on the Team page and confirm the review.
- Who can do this:
- Owner, Auditor, Privacy Officer (role defaults; the owner can change them)
An access review means checking that everyone in the store has only the access their job needs, closing accounts nobody uses, and keeping proof that you checked. The system suggests doing it every 90 days.
Who can do it
You need the Review team access permission, held by default by: Owner, Auditor, Privacy Officer. Store admins don't have it, because whoever grants access shouldn't be the one reviewing it.
What the access review shows
Each row is one person: role and branches, permissions added or removed individually, 2FA status, last activity, the number of sensitive permissions, and Findings.
| Finding | Meaning | What to do |
|---|---|---|
| 2FA required but off | This person's role or permissions require 2FA | Ask them to turn it on; see Turn on two-factor authentication (2FA) |
| Inactive for a long time | Not active for more than 90 days | Suspend them if they no longer need access |
| Conflicting permissions | Holds a pair that shouldn't sit with one person | Remove one of the two |
| Holds owner-only permissions | Was given an owner permission individually | Check it is really still needed |
| Extra permissions beyond the role | Was given extra permissions individually | Check they are really still needed |
Review and confirm
Open Access review.
Go through every row, especially rows with findings.
Remove unneeded access or suspend unused accounts under Team; see Change roles, suspend or remove staff.
Come back to the access review and tap Confirm review.
Write what you changed, or why you kept access, in Review notes and confirm.
The system keeps a snapshot of everyone's access at that moment as evidence. It can't be changed later and is recorded in the audit log.
When a review is due
-
A store that has never done a review is due straight away.
-
Once a review is due, the page shows a warning and owners get a notification every week until a review is confirmed.
Export to a file
Tap Export CSV to keep the list of people and their access outside the system. The system asks for your password again before the download and records who exported it.