---
title: "Best practices to keep your GiftPay account secure"
description: "While GiftPay takes many precautions to secure your GiftPay account and data, here are some recommended actions that you can take to help protect your account."
canonical_url: "https://help.giftpay.com/articles/best-practices-to-keep-your-giftpay-account-secure-4TrpXgaS5w"
md_url: "https://help.giftpay.com/articles/best-practices-to-keep-your-giftpay-account-secure-4TrpXgaS5w.md"
---
# Best practices to keep your GiftPay account secure

While GiftPay takes many precautions to secure your GiftPay account and data, here are some recommended actions that you can take to help protect your account.

If you have any questions please [contact us](https://express.giftpay.com/contactus.aspx).

## Do not share passwords

If more than one person uses your GiftPay account, do not share the same username and password between staff. Each individual that needs access to your GiftPay account should have their own username.

The security benefits of this approach include:

* Full traceability for all actions taken on your account;
* Ability to restrict or minimise permissions only to those that each staff member requires;
* Control over which email notifications each staff member receives;
* Easier offboarding when staff leave your organisation.


:::info
To learn how to do this, see [Can I add another user to my account?](/articles/can-i-add-another-user-to-my-account-iuGo8XSuPO)

:::

## Sign in with a bookmark

Bookmark the official GiftPay Express web site at https://express.giftpay.com and only sign in by clicking on the bookmark. This helps to ensure you’re on the genuine GiftPay sign in page when entering your username and password and not a phishing web site.

## Two-factor authentication

Ensure you have added two-factor authentication on your account, and also ask all of your users to turn it on too.

Two-factor authentication (or 2FA) adds a layer of protection that can prevent many phishing attacks and other risks. Each user just needs a smartphone.


:::tip
Every individual must have their own GiftPay user account to enable 2FA. You cannot share a username and password with other people if 2FA is turned on.

:::

You can monitor which of your users has 2FA turned on via the **Manage Users** page. 

If you’d like to enforce 2FA for all users, your GiftPay account manager can turn this on for your account on request.


:::info
For more information about two-factor authentication, see [How can I add two-factor authentication on my account?](/articles/how-can-i-add-two-factor-authentication-2fa-on-my-account-rFX6VqIrZC)

:::

## Master administrators

For medium to large organisations, it's a good idea to have at least two master administrators on your account.

Master administrators can add users, reset passwords, and disable 2FA, so you should setup policies that the master administrators must follow when performing these tasks, particularly for things like resetting passwords or disabling 2FA. For example, “2FA can only be disabled on request of the user with an in person or video call request, not via email or telephone.”

It's also important to have two master administrators in the event one is on leave, or in the case of staff departures. 

## User permissions

Set permissions for non-admin users at the lowest privilege required. For example, if a user only needs to be able to deliver gifts, you can set their permission level to Delivery Administrator.

Use a delivery approval workflow for tighter control of who can send out gifts from your account. In this scenario, User A sets up the batch (recipients, value etc.) and User B must review and approve the batch before the gifts are actually sent out. Ask your GiftPay account manager about how to set this up.

## Departing staff

Ensure a GiftPay Express user account is disabled when a staff member leaves your organisation. This should be part of your offboarding/leaving staff process.

It may also be a good idea to do a regular review of the current users on your account, to ensure that all enabled users still require access and have the appropriate permissions set.

## Email notifications

Ensure all relevant notification emails are turned on for each user, and setup internal processes to ensure these notification emails are reviewed and not ignored.