The desk
Security
Passwords are hashed. Email must be confirmed. Authenticator apps are supported. Payouts do not leave without a person.
Sign-in
Passwords use Argon2. A new client account cannot use the app until the email is confirmed. Sessions die after six hours. Optional Google Authenticator (TOTP) can be required after you enrol it.
Cookies
A session cookie and a small profile cookie keep you signed in and tell the site your role. We do not run advertising trackers on the account. Details are in the Privacy Policy.
Money movement
Payouts sit pending until a person reviews them. Staff only see assigned clients unless they are a manager. Nothing silently leaves the ledger.
If something looks wrong
We will never ask for your password. If a message does, ignore it and write to your agent from the address on the account.