While GiftPay takes many precautions to secure your GiftPay account and data, here are some recommended actions that you can take to help protect your account.

While GiftPay takes many precautions to secure your GiftPay account and data, here are some recommended actions that you can take to help protect your account.

If you have any questions please [contact us](https://express.giftpay.com/contactus.aspx).

## Do not share passwords

If more than one person uses your GiftPay account, do not share the same username and password between staff. Each individual that needs access to your GiftPay account should have their own username.

The security benefits of this approach include:

* Full traceability for all actions taken on your account;
* Ability to restrict or minimise permissions only to those that each staff member requires;
* Control over which email notifications each staff member receives;
* Easier offboarding when staff leave your organisation.


:::info
To learn how to do this, see [Can I add another user to my account?](/doc/can-i-add-another-user-to-my-account-iuGo8XSuPO)

:::

## Sign in with a bookmark

Bookmark the official GiftPay Express web site at https://express.giftpay.com and only sign in by clicking on the bookmark. This helps to ensure you’re on the genuine GiftPay sign in page when entering your username and password and not a phishing web site.

## Two-factor authentication

Ensure you have added two-factor authentication on your account, and also ask all of your users to turn it on too.

Two-factor authentication (or 2FA) adds a layer of protection that can prevent many phishing attacks and other risks. Each user just needs a smartphone.


:::tip
Every individual must have their own GiftPay user account to enable 2FA. You cannot share a username and password with other people if 2FA is turned on.

:::

You can monitor which of your users has 2FA turned on via the **Manage Users** page. 

If you’d like to enforce 2FA for all users, your GiftPay account manager can turn this on for your account on request.


:::info
For more information about two-factor authentication, see [How can I add two-factor authentication on my account?](/doc/how-can-i-add-two-factor-authentication-2fa-on-my-account-rFX6VqIrZC)

:::

## Master administrators

For medium to large organisations, it's a good idea to have at least two master administrators on your account.

Master administrators can add users, reset passwords, and disable 2FA, so you should setup policies that the master administrators must follow when performing these tasks, particularly for things like resetting passwords or disabling 2FA. For example, “2FA can only be disabled on request of the user with an in person or video call request, not via email or telephone.”

It's also important to have two master administrators in the event one is on leave, or in the case of staff departures. 

## User permissions

Set permissions for non-admin users at the lowest privilege required. For example, if a user only needs to be able to deliver gifts, you can set their permission level to Delivery Administrator.

Use a delivery approval workflow for tighter control of who can send out gifts from your account. In this scenario, User A sets up the batch (recipients, value etc.) and User B must review and approve the batch before the gifts are actually sent out. Ask your GiftPay account manager about how to set this up.

## Departing staff

Ensure a GiftPay Express user account is disabled when a staff member leaves your organisation. This should be part of your offboarding/leaving staff process.

It may also be a good idea to do a regular review of the current users on your account, to ensure that all enabled users still require access and have the appropriate permissions set.

## Email notifications

Ensure all relevant notification emails are turned on for each user, and setup internal processes to ensure these notification emails are reviewed and not ignored.

Best practices to keep your GiftPay account secure

How do I remove a user or team member from my GiftPay account?

Can I add another user to my account?

How can I add two-factor authentication (2FA) on my account?

Does GiftPay support Single Sign On (SSO)?

Managing Users & Security

Where can gift recipients redeem their eGift?

Can I buy single brand eGift Cards such as Amazon or Best Buy?

What is the minimum and maximum value gift I can send?

Do GiftPay eGifts expire?

If my eGift recipient chooses a charity donation eGift Card, how much does the charity receive?

eGift Cards in the US

What do my gift recipients need in order to be able to redeem a GiftPay eGift Card?

Can GiftPay eGift Cards be combined by recipients?

A gift recipient needs a password to open their eGift, where do they get the password from?

How does a gift recipient redeem their eGift?

Helping Your Gift Recipients use their eGift Cards

How do I use the bonus credit balance in my account?

How can I change my billing details such as company name and address?

Do the funds I have paid into my GiftPay account ever expire?

How can I deposit or add funds to my GiftPay account?

If I deposit funds to GiftPay and then later change my mind, can I get a refund?

What payment terms do you offer? Can I send gifts now and pay later?

Can I transfer funds between programs?

How do I cancel or delete an invoice?

How do I allocate funds from Unallocated Balance to a program?

How do I avoid the need to allocate or transfer funds between programs?

What are GiftPay programs used for?

How can I request a statement of account?

How do I request an invoice?

Can I pay via international bank transfer or with an international credit card?

I have just made a payment to GiftPay. When will the funds be available in my GiftPay account?

I've paid in funds to GiftPay but the balance in my account is still zero, where did the money go?

Account and Adding Funds

Can I cancel an eGift after it has been sent?

What does a gift status of "Valid (Clicked)" mean?

What does a gift status of "Valid (Used)" mean?

What can I do if a recipient claims they never received their eGift?

What happens if I deliver the eGift to the wrong email address?

What does it mean if an eGift has a status of "Used/Expired"?

A gift card email has bounced. What can I do?

Viewing and Managing Past Deliveries

How to add and edit programs

How to create personalised gift card messages

API Integration Guide

Step by Step Guides

Can I claim back a gift card that is unused or expired?

How is GiftPay better than other gift card and gift code suppliers?

Is it possible to customise the branding of my eGifts?

How can I send eGift Cards to other countries?

How soon can I start sending eGifts?

Custom branding image and file specifications

How can I get a preview of my custom branding?

Getting Started with GiftPay

If the service is free, how does GiftPay make a profit?

How secure is GiftPay?

Which countries can I send gift cards to?

What terms and conditions apply to each gift card?

How much does it cost to apply for a business account?

Do you sell plastic gift cards?

About GiftPay

What ordering and delivery methods does GiftPay offer?

How are eGifts delivered?

Can I send eGifts to a mobile via SMS/text?

Sending a large batch of eGifts with the same value and message

Can I deliver eGifts of different value or with different messages within the same delivery batch?

Is there a way to use GiftPay without divulging the email addresses of my gift recipients?

Can I send the gift cards to one email address and then forward them to my recipients?

Best practices to keep your GiftPay account secure

Share

Share

Best practices to keep your GiftPay account secure

Share

Share