Security
On this page
Security in Kartlo works at two levels:
- Your account: how you sign in, your password, two-step authentication and the devices you are signed in on. These are personal and live in your profile.
- Your store: idle sign-out, backups and the audit trail. These apply to everyone in the store and live in SettingsSecurity & data.
To open your profile, click your avatar on the taskbar, then click your name at the top of the menu. The profile has two tabs: General and Security.
Signing in#
You can sign in with your email and password, or with Google or Apple if you used one of them to sign up. Use the same method you signed up with.
If your email address is not verified yet, Kartlo asks you to confirm it first. Click Send verification email to get a fresh link.
Forgot your password#
To reset a forgotten password:
- On the sign-in page, click Forgot?.
- Enter your email address and click Send Reset Link.
- Open the email and follow the link to choose a new password.
The link expires in an hour. If you do not see the email, check your spam folder or request a new link. For privacy, Kartlo shows the same message whether or not an account exists for the address you typed.
Password and login methods#
Manage these in ProfileSecurity and ProfileGeneral.
| Setting | Where | What it does |
|---|---|---|
| Password | Security tab | Click Change password to set a new one. If you signed up with Google or Apple and have no password yet, click Create password. Email me a reset link sends a reset email instead. |
| Secondary email | Security tab | A second address used to restore access to your account and to receive security notifications. Kartlo emails it a code to confirm. |
| Login service | General tab | Click Connect Google to sign in with your Google account, or Disconnect to stop. You cannot disconnect Google if it is your only way to sign in. |
| General tab | Click Update next to your email to change your login email. Kartlo sends a confirmation link to the new address. |
A password must have at least 8 characters, with an uppercase letter, a lowercase letter, a number and a special character.
Two-step authentication#
Two-step authentication asks for a code from an authenticator app on your phone each time you sign in, after your password. Even if someone learns your password, they cannot sign in without the code. We recommend it for every store owner and admin.
To turn it on:
- Install an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator.
- Open ProfileSecurity and find Two-step authentication.
- Click Turn on two-step.
- Scan the QR code with your authenticator app. If you cannot scan it, type the key shown under Cannot scan? Enter this key in the app instead.
- Enter the 6-digit code from the app to confirm.
From then on, after your email and password Kartlo shows Two-step verification and asks for the current code from your app.
To turn it off, click Turn off two-step, enter a current code from your app, and click Turn off.
Signed-in devices#
ProfileSecurityDevices lists every browser and device where you are signed in to Kartlo. For each one you see the browser and operating system, when you signed in, when it was last active, and its approximate location and network address. The device you are using is marked This device.
- Click Log out next to a device to sign it out remotely.
- Click Log out of all other devices to sign out everywhere except where you are now.
Store admins can also see each staff member's last sign-in time, network address and approximate location in SettingsPeople & permissionsStore staff.
Confirming it is you#
Some sensitive actions, such as sending business verification documents, ask you to Confirm it is you first. Kartlo either emails you a 6-digit Security code, or asks you to sign in again with Google if that is how you sign in. The confirmation lasts 10 minutes, so you are not asked again for each step.
Store security settings#
These settings apply to everyone who works in the store. Open SettingsSecurity & data.
Idle sign-out#
Sign people out automatically when they walk away from a shared computer:
- Open the Idle sign-out tab.
- Set Session Timeout: the minutes of inactivity before a warning appears. Enter 0 to switch idle sign-out off. The maximum is 480 minutes (8 hours).
- Set Warning Countdown: how long the warning is shown before sign-out, from 1 to 30 minutes.
- Save.
Backups#
The Backups tab keeps copies of the store's data and files. Click Backup Now to create one straight away; it carries on in the background if you leave the page. Turn on Automatic Backup to create one every night.
Backup History lists every backup. Download a backup as Download ZIP (data + files), Download JSON or Download SQL.
Audit trail#
The Audit trail tab records who did what and when: records created, updated or deleted, sign-ins and sign-outs, failed sign-ins, password and role changes, exports and more. Filter by action, record type and date. Only administrators can view it.
Reset your store or delete your account#
Two permanent actions are at the bottom of ProfileGeneral. Both ask you to type your account email before the button works.
| Reset store | Delete account | |
|---|---|---|
| What it removes | Every product, collection, customer, order, invoice, discount, uploaded image, storefront setting, payment provider connection and team login in the store. | Your organization, every store under it and all their data, every login in the organization, and your Kartlo subscription. |
| What it keeps | Your account, organization, plan and subscription, store name and web address. | Only what Kartlo must keep by law or for security: the history of your Kartlo subscription payments (kept up to 5 years for UAE tax rules) and the record that a sign-up code was sent to your email. Copies in our encrypted database backups are erased within 30 days. |
| Who can do it | The organization owner only. | The organization owner. A team member who deletes their account removes only their own login; the stores and their data stay. |
| Afterwards | The store returns to how it was right after sign-up, and the guided setup starts again. | You are taken to the sign-up page. |
To reset the store:
- Open ProfileGeneral and scroll to Reset store.
- Type your account email.
- Click Reset to signup state.
To delete your account:
- Download a backup first if you need your data. See Backups above.
- Open ProfileGeneral and scroll to Delete account.
- Type your account email.
- Click Delete everything, or Delete my login if you are a team member.
In the Kartlo.App phone app (iPhone or Android), open SettingsProfile, tap Delete account and type DELETE to confirm. The same rules apply.
If you can no longer sign in, email hello@louward.com from your account email and ask us to delete your account. We confirm the request with you and then delete it.