How to secure your ScaleEdges account

Your ScaleEdges account gives access to your store, your products, your sales and your customers' data. This tutorial walks you through every protection available, in the order we recommend setting them up. Plan about ten minutes, and keep your phone within reach.

Every setting in this guide lives in the same place: Settings → Profile & security, the last tab of the settings menu. You can open it directly: Profile & security.

Before you begin

• Sign in to your own store. If you are a member of someone else's team, switch back to your own store first: the security PIN and session controls can only be managed from your own workspace.
• Install an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 2FAS, Aegis, Bitwarden or 1Password.
• Have a safe place ready to store your backup codes, ideally a password manager.

The order matters: the security PIN requires two-factor authentication, and team security requirements require your PIN. Follow the steps below from top to bottom.

Step 1: Use a strong password you never reuse

A strong password is your first line of defense. ScaleEdges requires at least 12 characters, but you should aim higher and mix:

• uppercase letters (A–Z);
• lowercase letters (a–z);
• numbers (0–9);
• special characters, such as ! ? # $ % & * @ _ -.

Most importantly, never reuse this password anywhere else. When another website suffers a data breach, attackers try the leaked email and password combinations on other services. A password used only on ScaleEdges cannot be exposed that way.

A few rules to follow:

• avoid your name, your store name, a birth date or a single dictionary word;
• prefer a long passphrase with symbols and numbers, for example Blue-Kettle!48-Orbit_Sunday, rather than a short, complex word;
• let a password manager generate and remember it for you;
• never share it, even with a teammate: invite them to your team instead (see step 5).

Change your password

1. Open Profile & security → Password.
2. Select Send me the password change email.
3. Open the email sent to your account address and follow the link.
4. Choose your new password and confirm it.

If you sign in with Google or Microsoft, your ScaleEdges security depends on that account. Protect it with its own strong password and two-factor authentication. You can review your connected providers in Sign-in methods.

Step 2: Turn on two-factor authentication (2FA)

With two-factor authentication, signing in requires a six-digit code from your phone in addition to your password. Even if someone learns your password, they cannot open your dashboard without that code.

1. Open Profile & security → Two-factor authentication.
2. Enter your Current password. If you sign in with Google or Microsoft, a secure window opens instead so you can confirm your identity.
3. Select Set up two-factor authentication.
4. Scan the QR code with your authenticator app. If you cannot scan it, select Copy next to the setup key and enter the key manually in the app.
5. Enter the six-digit code displayed by the app.
6. Select Confirm and enable.
7. ScaleEdges then shows 10 backup codes. Save them now with Copy codes or Download .txt, store them somewhere safe, then select I saved them.

Once 2FA is active, ScaleEdges asks for an authenticator code, or a backup code, after every new sign-in.

Each backup code works only once. If you lose your phone, a backup code is the only way back into your account. The card shows how many codes you have left; when they run low, enter your password and a current code, then select Generate new backup codes.

Turning two-factor authentication on or off also signs out your other sessions automatically.

Step 3: Create your security PIN

The security PIN is a secret six-digit code that ScaleEdges asks for before sensitive actions: exporting orders, customers or followers, changing team access, signing out a device, deleting your account and other protected actions. Someone who gains access to an open session still cannot perform these actions without it.

1. Make sure two-factor authentication is enabled (step 2).
2. Open Profile & security → Security PIN.
3. Enter your New six-digit PIN, then type it again in Confirm new PIN.
4. Enter your Current password (or confirm your identity in the Google or Microsoft window).
5. Enter your Current authenticator or backup code.
6. Select Create PIN.

Choose a PIN that is hard to guess. ScaleEdges refuses obvious ones such as 123456, 654321, a single repeated digit (111111) or a repeated pattern (121212, 123123). Avoid birthdays and years as well, and do not use your phone or bank card PIN.

After five incorrect attempts, PIN checks are locked for five minutes. If you forget your PIN, open the same card, enter your password and a 2FA code, and select Replace PIN; you do not need the old PIN.

Your PIN is never displayed or stored in plain text: ScaleEdges keeps only a protected hash of it.

Step 4: Check your active sessions and sign out other devices

The Active sessions card lists every browser currently signed in to your account, with its last activity, the date it signed in and an approximate network. Review it regularly, and immediately if you notice anything unusual.

1. Open Profile & security → Active sessions.
2. Check each line. Your current browser is marked This device.
3. To remove a session you do not recognize, or a computer you no longer use, select Sign out on its line.
4. To close every session except the one you are using, select Sign out every other device.
5. If you have created a security PIN, enter it to confirm.

The device loses access immediately and must sign in again, with its password and a 2FA code.

If you find a session you do not recognize, sign it out, then change your password right away (step 1), and check that two-factor authentication is still enabled.

We recommend signing out every other device after you change your password, after using a shared or public computer, or when you lose a phone or laptop.

Step 5: Require 2FA and a PIN for your team

If you work with collaborators, each one signs in with their own ScaleEdges account: never share your password. As the store owner, you can ask your whole team to meet the same security level as you.

1. Open Settings → Team.
2. Select the gear icon (Team security requirements) in the top corner of the team card. You can also go straight to Team security requirements.
3. Check Require two-factor authentication so that each teammate protects their account with an authenticator app.
4. Check Require a security PIN as well for the strictest protection. A PIN also requires two-factor authentication, so this option includes the first one.
5. Select Save security requirements.
6. Enter your own security PIN to confirm the change.

Saving these requirements is only possible once your own PIN is set up (step 3).

These requirements never lock anyone out. Here is what happens once they are active:

• the Members list shows a No 2FA or No PIN badge next to each teammate who does not meet the rules yet;
• existing members keep their access, and ScaleEdges reminds you how many of them still need to complete their security;
• when you invite someone who does not meet the requirements, ScaleEdges asks you to confirm before adding them.

Ask each teammate concerned to follow steps 2 and 3 of this guide in their own Profile & security tab. Their badges disappear as soon as they are done.

Security checklist

Your account is well protected when:

• your password is long, mixes uppercase, lowercase, numbers and special characters, and is used nowhere else;
• two-factor authentication is enabled and your backup codes are stored safely;
• your six-digit security PIN is set up and hard to guess;
• you have reviewed your active sessions and signed out the devices you no longer use;
• your team is required to use two-factor authentication and a security PIN.

Troubleshooting

The Security PIN card asks me to enable two-factor authentication first. Complete step 2, then come back to the PIN card.

I cannot see the PIN or session buttons. You are probably working in another store's workspace. Switch back to your own store and reopen Profile & security.

Saving team requirements shows "Set up your six-digit security PIN". Create your PIN first (step 3), then save the requirements again.

I lost my phone. Sign in with one of your backup codes, disable two-factor authentication, then set it up again on your new phone. Finally, sign out every other device.

I cannot see the gear icon in the Team tab. Only the store owner can change team security requirements. If you are a team member, ask the owner to turn them on.