Your Tambala account gives access to important parts of your business.

Depending on the permissions involved, someone may be able to see customers, change products, manage orders, update events or access financial information.

Good security does not need to be complicated.

Most problems can be prevented by controlling who has access and removing access when it is no longer needed.

Keep the owner account for the owner

Do not share your main Tambala login with employees, assistants, event staff or other people helping with the business.

Add them as teammates instead.

Your owner account should remain under your control because it has the highest level of access.

If ten people use the same owner account, you lose the ability to know who changed something and you make it much harder to remove one person's access later.

Individual teammate accounts solve that problem.

Give people only the access they need

Every additional permission creates another thing the teammate can see or change.

This does not mean you should distrust your staff.

It simply means access should match responsibility.

Someone checking tickets does not need payout access.

Someone managing products does not automatically need customer records.

Someone processing orders does not necessarily need permission to change business settings.

See Choose the Right Permissions for Teammates for help deciding what each role needs.

Keep login details private

Passwords and temporary login details should be shared privately.

Do not put them into public staff groups or send them to several people “just in case.”

Every teammate should use their own account.

If someone knows another person's password, change it.

Reset a password when something feels wrong

Do not wait for proof that an account has been compromised.

If a teammate accidentally shares their password, loses a device, or believes someone else may know their login details, reset the password.

A password reset is a simple way to close old access and start again.

Disable access quickly when someone leaves

When someone stops working with your business, their Tambala access should be reviewed immediately.

Do not wait until the end of the month or until you remember later.

If their departure is temporary, disabling the teammate may be enough.

If they have left permanently, remove their access according to your business process.

This should be part of the same departure routine as returning keys, uniforms, devices or other business property.

Review permissions when responsibilities change

A teammate does not need permanent access to everything they have ever worked on.

If someone moves from events to fulfilment, review their event permissions.

If temporary gate staff have finished working, remove the event assignment.

If a manager no longer handles payments, remove the payment permission.

Old access is easy to forget. Regular reviews prevent it from quietly building up.

Be especially careful with financial access

Permissions involving earnings, payout details or money deserve extra care.

Only give them to people who genuinely need them to perform their job.

If several people need to understand sales performance, analytics access may be enough. They do not necessarily need permission to move money.

Keep control of payouts with the smallest practical number of people.

Be careful with customer information

Customer names, contact information and order history should be used for legitimate business purposes.

Only teammates whose work involves customers should have access to that information.

Do not copy customer information into personal spreadsheets, unrelated WhatsApp groups or other places simply because it is convenient.

Keep customer information within the tools and processes your business actually needs.

Check unusual changes

If something important changes unexpectedly, investigate it.

For example:

A product price suddenly changes.

An order is cancelled unexpectedly.

A business setting is changed.

A teammate claims they did not perform an action.

Use the teammate activity and audit information available in Tambala to understand what happened.

See Review Teammate Activity for the full guide.

Review access regularly

You do not need to obsess over the Teammates page every day.

But from time to time, look through the people who have access to your business.

Ask:

Who still works with us?

Who still needs access?

Who has more permissions than their current job requires?

Are there temporary accounts that should now be disabled?

Has anyone been sharing an account?

A short review can catch problems early.

If you think an account has been compromised

Act quickly.

Change or reset the affected password.

Disable the teammate if necessary.

Review their recent activity.

Check whether important settings, orders, products or payment information were changed.

If the owner account itself may be compromised or you see activity you cannot explain, contact Tambala support.

Do not keep using an account normally while hoping the problem will disappear.

The important thing to remember

Account security is mostly about controlling access.

One person, one account.

Only the permissions they need.

Remove access when they no longer need it.

Investigate unusual activity quickly.

You do not need everyone to have full access for the business to work well.

A well-managed team can share the work while the owner remains in control.