USER ACCOUNTS · ACCESS SECURITY
Protect your account.
Keep access under control.
Account security includes how you sign in, how data is stored, and the timely change of permissions. Every team member should have their own account, and access should reflect their actual responsibilities.
Pay particular attention to access when someone changes roles, ends a working relationship, or there is suspicion of unauthorized use. Changing one account may not cover all related business tools.
Go through the guide
Protecting your account in everyday work
- Use your own account and a unique password, preferably saved in a password manager.
- Enter data at the official address provided to you for access.
- Do not share passwords, recovery links, or one-time codes with colleagues or through a support request.
- On a shared computer, sign out and do not save the password in someone else's browser profile.
- If additional sign-in verification is available for your account, use it according to the applicable instructions.
Verify an unexpected sign-in or recovery message through the official channel. Do not follow a request to send a password or code just because the message contains a familiar logo.
1. Agree on the change when a team member leaves
The responsible person should determine which accounts and tools the member had access to and which tasks need to be handed over. Record the user, vendor, and the time when the change should take effect.
Prepare the handover of open tasks and business contacts without sharing a personal password. Distinguish the need to preserve business records from the need for the departing person's old account to remain accessible to them.
2. Revoke or adjust the appropriate access
The change is carried out by a person with the necessary permissions or coordinated with Connect support. Based on the available options, the account access should be disabled or permissions and memberships that are no longer needed should be removed.
Do not consider changing a name or email address proof that access has been revoked. Do not delete a user solely to revoke access without checking the consequences for related business records.
Request a review of how existing sign-ins are handled if this is important for the case. Do not assume that all open sessions are automatically closed after every profile or permission change.
3. Check connected tools and shared secrets
Review the services the person accessed outside their Connect Marketplace account. Their accounts, sessions, and access credentials may be managed separately.
- Business email and shared mailboxes.
- Integrations, connected sales channels, and their separate accounts.
- Devices or applications used to process orders.
- Shared passwords and access keys known to the person, if any.
Coordinate the change of a shared key or password with the person responsible for the service so you do not unintentionally interrupt a business process. Before revoking access, check whether the tool uses its own credentials or depends on the person's user account.
If you suspect unauthorized access
Immediately notify the responsible person and Connect support. Provide the account, store, time, and observed event, such as an unexpected change or access message.
From a secure device and official address, change the password if you have access to the account. If you also suspect access to email, involve the person who manages that system. Changing the password alone may not resolve all related access.
Save the messages and information needed for verification. Do not include passwords, codes, or secret keys in the request.
Record what has been confirmed
- Which account was changed and for which vendor.
- Which permissions or accesses were revoked and who made the change.
- Whether existing sign-ins and connected business tools were checked.
- Who took over the open tasks and whether anything remains to be checked further.
The review is carried out by an authorized person through the available settings and support confirmation. Do not request the departing person's password to sign in on their behalf.
Frequently asked questions
Is changing the password of a departing colleague enough?
You should review the account, permissions, existing sign-ins, and access to connected tools. The scope of the required changes depends on how the account is actually used.
Do we have to delete the user account?
Revoking access and deleting records are not the same process. First check whether access can be disabled and what the consequences are for connected data.
Can a new employee and a former employee use the same account?
Assign a separate account to the new person. Adjust or revoke the previous person's access separately.
