Passwords and access to Torgsoft: rules for shops

What a shop owner should check first

After installing Torgsoft, change the default password for the Owner account. Give each employee a separate account with only the permissions needed for their work. Do not give the Owner password to sales staff or contractors. Review access as soon as an employee leaves or changes roles.

Use a different password for each work account. Change it if someone else has learned it, several people have used it, or you suspect it has been exposed. Changing passwords simply because a set period has passed is no substitute for reviewing permissions and closing unused accounts. The NIST password guidance calls for a change when there is evidence of compromise, not mandatory periodic replacement.

Why a shared account creates a risk

When several people sign in with one login, it is difficult to tell who performed an action in the software or to revoke one person's access without affecting everyone else. A shared password also has to be changed whenever a former employee should no longer know it. The UK National Cyber Security Centre recommends a separate work account for each person.

Separate access for the owner, administrators, sales staff and accounting staff according to their duties. A sales assistant does not need Owner privileges to process sales. Check who can see financial information, purchase prices, cash desks and other shops in a retail network.

How to set up employee accounts and permissions in Torgsoft

Torgsoft supports separate user logins and passwords. In the Ukrainian interface, open “Налаштування” → “Користувачі” (Settings → Users) to create an account or open an existing one. Each user is assigned a role that determines access to the software's functions. Several employees may have the same role while using separate accounts. The process is described in the Torgsoft access-permissions guide.

Permissions can also be refined for a particular user, including restrictions on accounting centres, cash desks and purchase prices. Review the settings when an employee's duties change. If you use the Torgsoft mobile app, check access to it separately in the user's account: according to the guide, the app uses that user's password.

How to change the Owner account password

1. Sign in to Torgsoft with an account authorised to change user settings.
2. Open “Налаштування” → “Користувачі”, select “Власник” (Owner) and click “Змінити” (Edit).
3. In the user record, click “Змінити пароль” (Change password). Enter the new password and repeat it to confirm.
4. Save the user record and check that you can sign in with the new password.

Store the new password in a protected password manager accessible only to authorised people. Do not send it in a work chat or leave it beside the point-of-sale computer. If sign-in fails after the change, check saved shortcuts and the settings of connected devices. The detailed procedure is in the Torgsoft password-change guide. If access is lost, contact your administrator or technical support.

When to change a password or close access

• After installation. Replace the default Owner password before starting to work with the shop's records.
• If exposure is suspected. If the password was given to an unauthorised person, stored in plain sight or there are signs of an unfamiliar sign-in, change it and review access.
• When an employee leaves or changes roles. Revoke access to an account they no longer need or adjust its permissions. If they knew a shared password, change that password too.

The owner should maintain a list of people with access to the software, work computers and connected services. Review it after staffing changes and during regular access reviews. The current NCSC guide for small organisations recommends removing or disabling unused accounts and periodically checking who can access important systems.

Quick checklist for the owner

• The default Owner password has been replaced, and only authorised people can access it.
• Each employee signs in with their own account.
• Roles and access to cash desks, purchase prices and accounting centres match job duties.
• Former employees' accounts no longer provide access to the software or connected services.
• Passwords are not reused for other services and are stored securely.

Sources

• Torgsoft. Setting employee access permissions.
• Torgsoft. Changing the default password.
• NIST SP 800-63B. Authentication and Authenticator Management.
• NCSC. Small organisations guide to cyber security: secure your important online accounts.