Keep employee access safe

Most problems with business data do not come from hackers but from access that was never taken back: a former employee who can still read every chat, or an API key that nobody remembers. These habits keep your Ha Tang business tidy. Owners and admins manage employees in Settings → Employees.

One person, one account

Give everyone their own Ha Tang account, invited by their own email address (Invite employees). Do not share one sign-in between several people:

• you cannot tell who replied to a customer or issued a refund;
• you cannot take access away from one person without locking everyone out;
• sign-in codes go to one mailbox, so the others depend on whoever reads it.

Give the lowest access that does the job

• Make people Members with per-module access unless they really manage the whole business. Keep Admin for the few people who run Ha Tang with you.
• Use the quick templates: Support for agents, Sales for salespeople, Finance for your accountant, Marketing for email campaigns (Employees and roles).
• Give Manage only to those who change settings, such as connecting channels or bank accounts.
• Give Developer (API keys, webhooks) only to people who build integrations. API keys can read and change data without anyone signing in.

Keep two owners

A business always has at least one owner, and only an owner can delete the business or change another owner. Name a second owner you trust, so the business is not stuck if the only owner leaves or loses access to their email.

When someone joins

1. Invite them with the template that fits their job; adjust levels if needed.
2. Check the summary in the Invite employee panel before you click Invite.
3. Ask them to install the Ha Tang app if they answer customers on the go (Ha Tang apps for phone and Mac).

When someone leaves

1. Open Settings → Employees and click Remove in their row. Their access ends at once, including in the apps, and their open conversations go back to the team.
2. Revoke any Pending invitations you no longer need.
3. If they had Developer access or were an admin, review Settings → API Keys and Settings → Webhooks. Keys and webhook secrets do not belong to a person and keep working after they leave: revoke the keys they created or knew and replace them (API keys, Webhooks).
4. If they could sign in to your channel accounts (Facebook, Zalo, TikTok) outside Ha Tang, remove them there too.

Review access regularly

Every few months, open Settings → Employees and check:

• Is everyone on the list still working with you?
• Does each person's access still match their job? The labels under Access show it at a glance.
• Are there Pending invitations that nobody will accept?

Protect the email behind each account

Ha Tang sends sign-in codes by email, so whoever controls an employee's mailbox can sign in as them. Ask your team to protect their email with a strong password and two-step verification, and to never share a sign-in code: Ha Tang never asks for it (Sign in and sign out).