Account Security Best Practices

Account Security Best Practices

Secure account access protects purchases, migration services, connection details, activity, and support records throughout the project.

Account access can expose service operations

An authorized account user may be able to view orders, purchased migration services, connection details, migration activity, and support records.

Maintain a secure account baseline

Area	Recommended practice
Passkeys	Add passkeys only on devices, browser profiles, or security keys controlled by authorized users.
Password	Use a unique password that is not reused for a source store, target store, or hosting account.
2FA	Enable two-factor authentication for accounts that manage purchases or migration services.
Backup Codes	Store valid, unused Backup Codes securely and outside the primary authentication device.
Account email	Protect access to the email used for verification and recovery.
Account Connections	Keep only authorized Google, Apple, and Facebook accounts connected.
Login Activity	Review unfamiliar devices, locations, IP addresses, and failed attempts.

Before migration work

Confirm that:

• the migration owner and any delegated collaborators who still require access are identified;
• only authorized users can access the account;
• registered passkeys belong only to authorized users and controlled devices;
• the account email can receive verification and support messages;
• 2FA and recovery methods are available;
• recent Login Activity does not show unexplained successful access.

During migration work

• Do not share passwords, Backup Codes, API tokens, or private keys through ordinary tickets or chat messages.
• Grant only the access needed to complete connection, migration, validation, or support tasks.
• Review Login Activity after password, 2FA, email, or Account Connection changes.
• When another person needs to operate a purchased migration, use Delegate Access instead of sharing the main account sign-in.

After migration work

Cleanup task	Why it matters
Revoke temporary API credentials	Prevents unused platform access from remaining active.
Revoke delegated migration access	Removes collaborator or support access that is no longer needed. Use Delegate Access.
Remove KitConnect	Removes temporary connection files from each store where KitConnect was installed, after migration and required follow-up work are complete and accepted.
Rotate temporary store or server passwords	Invalidates credentials shared for migration work.
Review Account Connections	Confirms that only authorized social accounts remain connected.
Review Login Activity	Confirms there are no unexpected sign-ins after completion.
Close or update support records	Keeps the final issue and access state clear.

Respond to suspicious activity

1. Change the account password.
2. Confirm that other active sessions were signed out.
3. Review Account Connections and disconnect anything unauthorized.
4. Enable 2FA or regenerate Backup Codes.
5. Review Login Activity for unfamiliar devices, locations, IP addresses, or failed attempts.
6. Check Orders, Checkout, and Support for unexpected activity. For purchased migration activity, expand Migrations and select My Migrations.
7. Submit a Support Ticket with the affected account email, activity time, device, location, IP address, and relevant migration service.

Privacy and regulatory questions

The Data Policy governs migration-related data that Next-Cart may collect, process, and store to establish connections, configure and perform migrations, record migration activity, validate results, and provide migration-related support. Depending on the migration path and connection method, this can include Source Store and Target Store URLs, authorized API credentials or access tokens, uploaded data files, migration configuration, activity metadata, record identifiers used to preserve relationships, and support evidence.

Next-Cart processes migrated record contents as necessary to transfer data between the Source Store and Target Store. The migration process is not a permanent backup service. The Data Policy also describes technical and organizational security measures, restricted access to personnel and systems that require the information, purpose-limited sharing, retention based on service, security, dispute, and legal needs, and data-protection rights where applicable under law.

Customers should provide only the access and evidence required for the task. Do not place passwords, 2FA codes, Backup Codes, private keys, unnecessary payment information, or plaintext customer passwords in Support Tickets. When sensitive access is required, use Delegate Access or the secure transfer method requested by Support. Revoke or rotate temporary API credentials, hosting access, administrator credentials, and temporary support accounts after they are no longer required.

These controls do not by themselves establish a blanket GDPR certification for every customer scenario. Privacy and regulatory obligations depend on the applicable data, processing relationship, jurisdiction, Agreement, Data Policy, and applicable law. Use those governing materials for organization-specific compliance assessment rather than treating successful migration or secure credential handling as a universal legal guarantee.

Next Steps

• Use Security to change sign-in protection or review Login Activity.
• Use Settings to change the account email or delete the account.
• Use Migrations to review purchased migration-service activity.
• Use Delegate Access to review or revoke migration-level access.