Published Last updated Written and reviewed by the Resale Intelligence team
On this page
Owners and store admins need 2FA at once. Roles that reach money or customer data, like managers, get a grace period. Owners can require it for everyone.
The system requires 2FA based on what each person can reach. The more someone can do with money, customer data or other people's access, the more protection they need.
Who must use 2FA and from when
| Who | Required from |
|---|---|
| Store owners and store admins | Straight away, before they can use the system |
| Managers, Supervisor-Approvers, Accountants, Auditors and Privacy Officers | After a grace period of 14 days |
| Staff in other roles who were given a sensitive permission individually, such as voiding or recording cash | After a grace period of 14 days |
| Everyone in the store, when the owner turns on the store-wide option | Straight away |
The remaining roles, Cashier, Appraiser, Technician, Inventory staff and Viewer, use 2FA as the store decides, but we recommend it for everyone.
How the grace period is counted
The grace period runs from the day the person joined the store, or the day this policy started, whichever is later. During it a yellow banner on every page shows the last day and a Set up now link.
After the last day, every store page sends the person to Account security with the message Two-factor authentication is required until 2FA is on.
Approvers always need 2FA
Approving someone else's action, such as a purchase above the limit, a void or a refund, uses the 6-digit code from the approver's own app. Anyone without 2FA can't approve, even if their role doesn't require it. See Why some tasks need a second person.
Owners can require it for the whole store
Open Store settings.
On the Security card, tick Require two-factor authentication (2FA) for everyone in the store.
Tap Save settings and confirm your password again.
This takes effect at once, with no grace period. Staff without 2FA are sent to the setup page the next time they open a store page, so tell the team first.
See who hasn't turned on 2FA
-
Team has a 2FA column showing on or off for each person.
-
Access review lists a finding for anyone who needs 2FA but hasn't turned it on. See Review your team's access regularly.