# Account security

> Two-factor sign-in with an authenticator app or passkeys, recovery codes, sessions, and the re-confirmation Sellstamp asks for before sensitive changes.

Page: https://sellstamp.com/docs/account/security

## Two-factor sign-in

Under **Settings → Security**, add an authenticator app, a passkey, or both. Once either is on, a password alone never signs you in. Your first factor comes with a set of recovery codes. Store them somewhere safe: each works once, and support cannot recover them.

A passkey can also be your whole sign-in, with no password to type, because the device already checks it is you.

## Confirming it is you

Some changes ask for your password, and your second factor if you have one, even though you are signed in. A confirmation lasts a few minutes and covers one kind of change:

- Payment credentials and payout details.
- Your plan and billing.
- Two-factor settings and recovery codes.
- Teammates' roles and removals.
- Archiving a store.
- API keys, and exports that leave Sellstamp.
- Notification channels such as Discord and Telegram, and integrations.
- Revealing a licence key or resetting its activations.

A confirmation for one kind of change never covers another. Confirming for billing does not let the same session change where payments go.

## Sessions and alerts

The security page lists where you are signed in, with a coarse device and network summary, and can sign you out everywhere at once. Security alerts, such as a password change or two-factor being turned off, are always emailed and cannot be switched off.

## A workspace policy

An owner can require two-factor sign-in for owners and admins, or for everyone. Members who have not set it up keep their membership and data, but can only reach the security page until they enrol.

## Not offered

SMS or email codes as a second factor. Both are weaker than an app or a passkey.

## When Sellstamp reviews your store

Sellstamp reads what a store shows the public when it publishes and when it changes, looking for phishing: a store name that imitates a bank or payment brand, text asking buyers to send their card number, CVV, seed phrase or a one-time code, or links that take payment outside checkout. A person reviews what it finds. If a match is serious, the store cannot be published until it is reviewed; your store overview shows exactly what matched, and you can change it or appeal.

Staff act in steps, each with a reason you can read and answer from your store overview: a warning, then pausing payouts (new payments through your connections pause; your store and paid orders do not), then suspension. Your EU trader details (phone and a compliance statement) live in store settings. Sellstamp reads them, and nothing about selling depends on them.

If you sell themes or apps, a sale bought by your own workspace, or from your own device or card, can be held for review: the buyer still gets it, and your share shows as held on your payout panel until a person clears it. Referral credit is not paid for a workspace that is yours under another name, and several trials started from one device are reviewed by a person. None of this refuses a sale or a trial.