Users and security

You give an employee access by creating their own user and assigning a rights group to it.

1. Create a user for the employee.
2. Assign a rights group.
3. Restrict departments and high-risk actions where needed.
4. Test the access with the user account itself.

Use a separate account for each employee, so it is clear who did what. Check rights from the perspective of a normal user, not only as an administrator. Revoke access immediately when someone changes role or leaves.

A user gets individual rights or a rights group, and only sees the data and actions that this rights profile gives access to.

There are rights for viewing, adding, editing and deleting, and for special actions such as finalising, delivering, synchronising or seeing report totals. Dashboard cards also only appear for users with the right permissions.

With a rights group you give several employees the same rights at once. Treat deleting, clearing stock, full synchronisation and finalising as high-risk actions, and only grant them to those who really need them.

Yes. Count-IT supports two-factor authentication with a code by email or with an authenticator app.

You set this up on your account page: choose the method you want and then link your authenticator app or email address. When you log in, Count-IT then asks for the code in addition to your password. This protects your account better, even if someone knows your password.

Device registration links a device, such as a till, to your organisation and a licence. Certain functions, such as the POS, only work on a registered device.

Device types that can be registered include till, PC/laptop, tablet, phone and scanning terminal. With the setting Registered security device required you restrict secured fiscal functions to a validly registered device.

Getting a message that the device or till is not allowed? Check whether the device is registered, whether a valid licence is linked to it and whether the device type may use the POS. An administrator can unlink a licence from an old device and link it to the new one.

Yes. With Login with code employees can log in with a POS code, and with Allowed network addresses for code login you restrict this to your own configured locations.

This way, quick code login works on the shop floor but not from outside. You will find both settings in the settings for users and login.

With Automatic logout after seconds, Count-IT logs a user out after a set period without activity.

This value applies to the whole organisation. With Local override for automatic logout you override it on the current device only, for example a shorter time on a till in a busy area. If you want employees to log in again after every sale, use the POS setting Lock after checkout.

You give support access through temporary support access with an end date. As the customer, you decide whether and for how long a support employee can access your account.

Always give temporary support access a short end date. After that date the access expires automatically. Never share your own password with support or anyone else; always use the temporary access. Need help? See the support page.

Yes. Count-IT has a Suspicious employee activity report, also available as a dashboard block. It shows notable actions per employee, such as cancelled receipts and payments, deletions, discounts and price changes.

This helps you quickly see where it is worth taking a closer look. A signal is not proof: review the underlying transactions before drawing conclusions. This report requires the appropriate report rights.

You can protect high-risk POS actions with a security code, so that only authorised employees can carry them out.

• Refund - Code (under POS settings › Security): the POS asks for this code before every negative payment, whatever the payment method. An empty field switches the check off.
• Security codes for cancelling, cancelling payment and returns: require the configured code for those actions.
• POS discount code: protects manual discounts.
• Login code required for drawer: protects opening the cash drawer manually.

Reload the POS after changing a setting.

Yes. With General account switching authorised users can switch without fully logging out, and with Switch employee the POS shows account buttons for each employee.

This keeps every sale linked to the employee who made it. With Save receipt per user you explicitly link receipts to the active user, and with Show “Served by” you record or show which employee served the customer.

Yes. Departments let you separate turnover, users, warehouses and printers, among other things, and a user only sees data that their rights profile gives access to.

• Disable department switching locks users to their department.
• Department switching for administrator lets authorised administrators work outside their normal department.
• Only POS department at login limits the selection list to POS-related departments.

In the History menu you can see, among other things, the emails sent and the processing of synchronisations with linked apps.

This lets you check whether an invoice or order confirmation was actually sent, and whether an integration processed data correctly. Is an email not being sent? Check the sender account, recipient, email template, attachment size and the email history. Do not click send repeatedly: that can cause duplicate emails.

The most important rule: never share passwords, API keys, MCP tokens, app secrets or payment terminal codes by email, chat or in documentation.

• Use a separate account for each employee and a separate identity for each integration.
• Give temporary support access a short end date.
• Revoke access immediately when someone changes role, leaves or a data breach is suspected.
• Only export the data you need and store exports in line with your privacy policy.
• Do not use real customer data for tests when a test contact will do.
• Make a reference export before large imports or bulk actions.