# Keep employee access safe

Good habits for who can see and change what in your business, and a checklist for when someone joins or leaves.

Most problems with business data do not come from hackers but from access that was never taken back: a former employee who can still read every chat, or an API key that nobody remembers. These habits keep your Ha Tang business tidy. Owners and admins manage employees in **Settings → Employees**.

## One person, one account

Give everyone their own Ha Tang account, invited by their own email address ([Invite employees](https://hatang.dev/help/account/invite-employees)). Do not share one sign-in between several people:

- you cannot tell who replied to a customer or issued a refund;
- you cannot take access away from one person without locking everyone out;
- sign-in codes go to one mailbox, so the others depend on whoever reads it.

## Give the lowest access that does the job

- Make people **Members** with per-module access unless they really manage the whole business. Keep **Admin** for the few people who run Ha Tang with you.
- Use the quick templates: **Support** for agents, **Sales** for salespeople, **Finance** for your accountant, **Marketing** for email campaigns ([Employees and roles](https://hatang.dev/help/account/employees-and-roles)).
- Give **Manage** only to those who change settings, such as connecting channels or bank accounts.
- Give **Developer (API keys, webhooks)** only to people who build integrations. API keys can read and change data without anyone signing in.

## Keep two owners

A business always has at least one owner, and only an owner can delete the business or change another owner. Name a second owner you trust, so the business is not stuck if the only owner leaves or loses access to their email.

## When someone joins

1. Invite them with the template that fits their job; adjust levels if needed.
2. Check the summary in the **Invite employee** panel before you click **Invite**.
3. Ask them to install the Ha Tang app if they answer customers on the go ([Ha Tang apps for phone and Mac](https://hatang.dev/help/getting-started/mobile-and-desktop-apps)).

## When someone leaves

1. Open **Settings → Employees** and click **Remove** in their row. Their access ends at once, including in the apps, and their open conversations go back to the team.
2. Revoke any **Pending invitations** you no longer need.
3. If they had **Developer** access or were an admin, review **Settings → API Keys** and **Settings → Webhooks**. Keys and webhook secrets do not belong to a person and keep working after they leave: revoke the keys they created or knew and replace them ([API keys](https://hatang.dev/help/integrations/api-keys), [Webhooks](https://hatang.dev/help/integrations/webhooks)).
4. If they could sign in to your channel accounts (Facebook, Zalo, TikTok) outside Ha Tang, remove them there too.

## Review access regularly

Every few months, open **Settings → Employees** and check:

- Is everyone on the list still working with you?
- Does each person's access still match their job? The labels under **Access** show it at a glance.
- Are there **Pending invitations** that nobody will accept?

## Protect the email behind each account

Ha Tang sends sign-in codes by email, so whoever controls an employee's mailbox can sign in as them. Ask your team to protect their email with a strong password and two-step verification, and to never share a sign-in code: Ha Tang never asks for it ([Sign in and sign out](https://hatang.dev/help/account/sign-in)).