Account security

Under Settings → Security, add an authenticator app, a passkey, or both. Once either is on, a password alone never signs you in. Your first factor comes with a set of recovery codes. Store them somewhere safe: each works once, and support cannot recover them.

A passkey can also be your whole sign-in, with no password to type, because the device already checks it is you.

Some changes ask for your password, and your second factor if you have one, even though you are signed in. A confirmation lasts a few minutes and covers one kind of change:

• Payment credentials and payout details.
• Your plan and billing.
• Two-factor settings and recovery codes.
• Teammates' roles and removals.
• Archiving a store.
• API keys, and exports that leave Sellstamp.
• Notification channels such as Discord and Telegram, and integrations.
• Revealing a licence key or resetting its activations.

The security page lists where you are signed in, with a coarse device and network summary, and can sign you out everywhere at once. Security alerts, such as a password change or two-factor being turned off, are always emailed and cannot be switched off.

An owner can require two-factor sign-in for owners and admins, or for everyone. Members who have not set it up keep their membership and data, but can only reach the security page until they enrol.

SMS or email codes as a second factor. Both are weaker than an app or a passkey.

Sellstamp reads what a store shows the public when it publishes and when it changes, looking for phishing: a store name that imitates a bank or payment brand, text asking buyers to send their card number, CVV, seed phrase or a one-time code, or links that take payment outside checkout. A person reviews what it finds. If a match is serious, the store cannot be published until it is reviewed; your store overview shows exactly what matched, and you can change it or appeal.

Staff act in steps, each with a reason you can read and answer from your store overview: a warning, then pausing payouts (new payments through your connections pause; your store and paid orders do not), then suspension. Your EU trader details (phone and a compliance statement) live in store settings. Sellstamp reads them, and nothing about selling depends on them.

If you sell themes or apps, a sale bought by your own workspace, or from your own device or card, can be held for review: the buyer still gets it, and your share shows as held on your payout panel until a person clears it. Referral credit is not paid for a workspace that is yours under another name, and several trials started from one device are reviewed by a person. None of this refuses a sale or a trial.