Users
Everyday accounts. A user registers, confirms their email, and works from a dashboard with their own profile, password and registered address.
About
Simple tools for your account. It is the account layer — sign-in, verification, profiles and permissions — for the people who use a product, the people it serves, and the people who run it.
Everyday accounts. A user registers, confirms their email, and works from a dashboard with their own profile, password and registered address.
The people you serve. Customers register and sign in through their own doors, and their accounts never share a session or a permission with staff.
Operators. Admin accounts are created inside the application, never by public signup, and sit in a hierarchy that decides who may manage whom.
How it is built
The parts of the design that affect you directly, rather than a list of technologies.
Registration parks your name and address in a holding area for ten minutes. Nothing is written to the live account table until you have entered the emailed code and chosen a password — so an abandoned signup leaves the address free rather than stranded.
Verification and recovery use a six-digit code that expires in ten minutes and is destroyed after five wrong guesses. Codes are stored hashed, so a copy of the database does not hand anyone a way in.
Every request re-checks your account against the session holding it. Change your password — or have it reset — and sessions opened anywhere else stop working immediately, which is what makes recovery worth anything.
Staff access is granted one activity at a time — viewing, creating, editing and deleting are separate rights — so somebody can be given the job they do without being given everything else along with it.
Our contact details are on one page, along with the two things you can settle yourself.