Team & roles

Invite your team

Team → Invite: enter their email and choose a role. They get an email to set their password. Built-in roles:

Custom roles

Team → Roles lets you make your own role — for example Packer — and choose, area by area (orders, products, customers, marketing, settings…), whether it can view, edit or not see it at all. Menu items a person can't use are hidden for them.

Activity log

Activity log shows who did what and when — price changes, refunds, settings changes, sign-ins — so you can see what happened on any day.

Security log

Security log (owners and managers) lists everything that touches who can get in, with who, when and from where (IP address and browser): sign-ins, wrong passwords and blocked sign-ins, sign-ins with a recovery code, two-step sign-in turned on, off or reset, password reset links and new passwords, invitations, role changes, removed members, roles saved or deleted, API keys made or revoked, webhooks added, paused or deleted, and downloads of shipping labels, packing slips, customer lists, product CSVs and GST reports. Warning signs are in red. Filter by kind, person and dates. Entries are kept for 13 months, then removed automatically. A wrong password from a place you don't recognise? Change your password and turn on two-step sign-in.

Account security

Owners verify their email; forgotten passwords are reset by a single-use email link; repeated wrong passwords are slowed down. Remove a team member and they lose access on their next click.

New passwords — when you sign up, accept an invitation or reset one — need at least 10 characters, can't contain your email's name or the store's name, can't be one of the most common passwords, and can't be one that has appeared in a known data breach (checked privately: only the first 5 characters of a scrambled fingerprint of the password leave BazaarSaaS, never the password). A short sentence is easy to remember and hard to guess. Your buyers' passwords follow the same rules, with the reason shown in their language.

Morning email

Turn on Morning email in Your account and every morning after 8 AM you get one short email: yesterday's orders and sales, and what needs doing today — orders to pack, orders late to ship, shipments due today, returns waiting, enquiries to answer, new checkout leads and products running low. It only shows what your role can see (sales need Reports, the to-do list needs Orders, leads need Customers, stock needs Products). A day with nothing to report says so in one line. Each team member turns it on for themselves; turn it off there any time.

Alerts on this browser

In Your account → Alerts on this browser, press Turn on alerts and allow notifications: from then on this computer or phone pops up an alert the moment a new order comes in, a buyer asks for a return, orders are late to ship (once a day, after 9 AM) or products run low — even with the admin closed. Click the alert to open that order or list. Each team member turns it on in each browser they use, and only gets alerts for what their role can see (orders need Orders, low stock needs Products). Send a test shows what one looks like; Turn off on this browser stops them there. The owner chooses which alerts go in Settings → Notifications (the Push column). On an iPhone, add the admin to your Home Screen first and turn alerts on from there.

Two-step sign-in

Open Your account (under your name, top right) and turn on two-step sign-in: scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy), type the code it shows, and save the 10 recovery codes — each signs you in once if you lose your phone. From then on, signing in needs your password and the 6-digit code from the app; tick Don't ask again on this device for 30 days on a computer you trust. Make new recovery codes there any time (the old ones stop working).

Owners can require it for everyone: anyone without it sets it up at their next sign-in. If a team member loses their phone, the owner presses Reset two-step next to them in Team; if the owner loses theirs and the recovery codes, BazaarSaaS support can reset it after checking it's really you. Apps signing in through the API send the code too (code next to the password).