Review security settings

Security settings help protect your sign-in and who on your team can change billing, settings, and customer records.

Use this guide when you are setting up how you sign in, checking who has admin access, or building a simple monthly security habit for your facility.

What you will accomplish

Open Settings > Security and add a passkey on the device you use every day.
Understand when to use a passkey vs a magic link email.
Review Settings > Team so only trusted people have admin access.
Know what to do if someone leaves your company or loses a device.

Before you start

Use your own account. Do not share sign-in links or devices with another staff member.
Have the device you normally use for work, such as your laptop or phone.
Know your device unlock method, such as Face ID, Touch ID, Windows Hello, a PIN, or a security key.
Review Team permissions if you need to remove staff access or change admin access.

Open Security settings

Go to Settings > Security.

The page title is Security.

Security settings page showing Passkeys section — Security settings let you manage passkeys for faster and safer sign-in.

Understand passkeys

A passkey lets you sign in using your device instead of typing a password.

Examples include Face ID, Touch ID, Windows Hello, your phone screen lock, or a physical security key.

Passkeys are safer because they are tied to your device and are much harder for someone to steal with a fake sign-in page.

Add a passkey

Find Passkeys
On Settings > Security, find the section named Passkeys.
Click the add passkey button
Click the button to add or create a passkey.
The exact wording may depend on your browser and device.

Security settings Passkeys section showing listed passkeys and button to add a new passkey — The **Passkeys** section lists devices you already set up and gives you a button to add another.

Follow your device prompt
Your device may ask you to use Face ID, Touch ID, Windows Hello, your computer PIN, your phone, or a security key.
Follow the prompt shown by your device or browser.
Confirm it appears in the Passkeys list
After setup finishes, return to the Passkeys section and confirm the new passkey appears.
Expected result: You see at least one passkey listed for the device you used.

Expected result

You can use the passkey for faster, safer sign-in on that device. On your next sign-in, choose the passkey option instead of waiting for an email link when your device offers it.

Sign in with a passkey next time

Open the staff sign-in page
Go to your facility sign-in page (the same page you use today). Do not use a customer portal link.
Enter your work email
Type the email address tied to your staff account—the same one that receives magic-link emails.
Choose the passkey option when it appears
Your browser or device may ask you to use Face ID, Touch ID, Windows Hello, or your phone.
Why this matters: A passkey proves it is really you without copying a link from email. That reduces the chance someone else signs in if they get access to your inbox.
Use magic link only when needed
If you are on a shared computer, a device without biometrics, or passkeys are blocked by your company, use the email magic link instead.
Expected result: You reach the Dashboard with your name and facility showing correctly.

Review admin access

Passkeys protect your own sign-in. Team permissions protect the facility.

Team settings page showing staff list with Permissions, Notifications, and Actions columns — Open **Settings > Team** to see who has access. The **Permissions** column shows whether someone is an admin or has a custom set of areas.

Open Team settings
Go to Settings > Team.
Scroll past Default dashboard layout until you see the Team table with staff names and emails.
Review who has admin access
In the Permissions column, look for teammates whose button shows Admin or Full Access.
Admins may be able to change billing, settings, team access, and other sensitive information. A button such as 4/10 means custom access to four areas out of ten.
Remove access that is not needed
If someone no longer needs admin access, reduce their permissions.
If someone left your company, remove their access.

Use a simple monthly security review

Pick one day each month (for example, the first Monday) and walk through this short list. It usually takes less than 15 minutes.

Check your own passkey
Open Settings > Security. Confirm your current device still appears under Passkeys.
Add a passkey on a new laptop or phone when you start using it for work.
Review the Team table
Open Settings > Team. Look for people who no longer work with you and remove their access the same day they leave.
Expected result: Only current staff can sign in.
Count admin accounts
In the Permissions column, note how many people show Admin or Full Access.
Ask whether each person still needs that level. Most day-to-day staff should use custom permissions instead. See Manage team permissions.
Confirm billing access
Only people who send invoices, change prices, or connect Stripe should have Payments and Admin access.
Why this matters: Billing mistakes are harder to undo than a wrong appointment note.

Each staff member uses their own account—no shared logins.
Owners and managers add passkeys where possible.
Admin access is limited to trusted people who need it.
Former employees are removed from Team immediately.
Nobody forwards magic-link emails to coworkers.

Troubleshooting

What to do next

If you are setting up a new team, ask each owner or manager to add a passkey. Then review Team permissions so staff have only the access they need.