Your team, roles & security

Two kinds of login

• Operators (PIN): everyone on the floor gets a name and a 6-digit PIN. Fast to type between parcels, no emails or passwords to manage.
• The founder (email + password): the owner account that guards the serious stuff. Creating it is part of onboarding, and the email must be verified before the workspace can connect stores or sync customer data.

Roles: who sees and does what

Notice the pattern: powerful actions exist, but they always demand a reason and are always logged with a name.

Shared computers, handled properly

Warehouse stations are shared. So:

• Signing out drops the powerful founder login but lets PIN operators keep working; one button locks the station down between manager visits.
• Sensitive actions (changing PINs, team changes, credential edits) ask for the founder password again, and again after 15 idle minutes.
• "Sign out everywhere" kicks every browser session if a laptop walks off.

Attack-proofing you never have to think about

• Wrong-PIN and wrong-password attempts get slowed and locked out, and the lockout follows the account, so switching WiFi doesn't reset it.
• Your Shopify/Shiprocket keys are stored encrypted; they're never shown back, never included in exports, and you can rotate them anytime.
• Every brand's data is fenced off from every other brand at the database level: two separate walls, so even an application bug can't cross.

The audit trail

Every meaningful action (a confirmation, an address edit, a pack, an override, a dispatch close, a settings change) is written to a permanent activity log with who/what/when. Any order's page shows its own history. "Who packed this?" always has an answer.

Your data is yours

Settings → Your data gives the founder a full export (every order, stock line, movement, record, as CSVs) anytime, and a delete-workspace option that removes everything permanently. No lock-in by hostage-taking.