> ## Documentation Index > Fetch the complete documentation index at: https://docs.levelset.io/llms.txt > Use this file to discover all available pages before exploring further. # Security and access > Set up Levelset securely: give each person only the access they need, remove it when they leave, reset passwords and PINs, control store tablets and store links, disconnect integrations, and report a concern The security settings to set when you start on Levelset, and what to do when someone joins or leaves. ## How access works A **login** is the email and password someone signs in with. What it can do comes from its **permission level**, a named set of permissions. Your organization defines its own **roles**, ranked from the Operator down, each with a permission level of the same name; a **custom level** is one made for particular people. People manage only those below them in the role order. See [Roles](https://docs.levelset.io/team/roles.md). **Levelset Admin** is a role held only by Levelset staff, to set up and support your account. Your organization can't give it to anyone. ## Give each person only what they need 1. Open **People > Team & Access** and click the **Roles** tab. 2. Click **Edit permissions** on each role and untick what that role doesn't need. 3. On the **Access** tab, click **Invite** on a team member's row. They get an email and set their own password. 4. To give one person less than their role, open their panel and pick a custom level under **Permission level**. 5. Under **Stores they can see**, tick only their stores. See [Access](https://docs.levelset.io/team/access.md). ## Reset a password * **The person:** on the sign-in page, enter the email and click **Forgot password?**. The **Reset your Levelset password** email has a **Reset password** button. The link works once and expires shortly. * **A manager:** on the **Access** tab, open the person's panel and click **Send password reset**. Tick **Require a new password at next sign-in** first to sign them out everywhere at once and make them set a new password before they continue. This takes Access > Manage Users, for someone below you in the role order. ## Remove access 1. On the **Access** tab, click the person's name. 2. Under **Remove access**, click **Remove access now**, then **Remove access**. They are signed out everywhere at once, on the web and in the Levelset app, and can't sign back in. Their clock-in PIN and Slack link stop working too; their history stays. **Restore access** lets them sign in again, but leaves the Levelset app off and their Slack link and connected apps waiting to be approved again; see [Remove someone's access](https://docs.levelset.io/team/access.md#remove-someones-access). **Terminate team member** on the **Team members** tab normally removes the login too; if the **Access** tab still shows them, remove it as above. When someone changes role, change it on **Team members**: a login on **Role default** takes the new role's permissions. ## Kiosk Mode and clock-in PINs On the Deploy plan, a store tablet runs **Kiosk Mode** (started with **Start Kiosk Mode** in the Levelset app), and team members sign in on it with their **clock-in PIN**, the 5 or 6 digit PIN they use on the Chick-fil-A POS. * **Set a PIN:** a team member sets their own under **Account** > **Set my clock-in PIN** in the Levelset app. A manager uses the three-dot menu on the person's row on **Team members**: **Clock-in PIN**, **Set a new clock-in PIN**, **Save PIN**. * **Reveal a PIN:** **Reveal PIN** in the same window. Every reveal and every PIN change is recorded with who did it, and a reveal that can't be recorded doesn't happen. * **Who can:** another person's PIN takes Team Members > Edit Employee, for someone below you in the role order. * **Wrong PINs:** five wrong tries lock that person out for 15 minutes. A Kiosk Mode sign-in ends after three hours with no activity. * **Lost tablet:** on **Organization > Set up > Store details**, find it under **Kiosk Mode tablets**, click **Revoke**, then **Revoke this tablet**. It is signed out at once. Setting up or revoking a Kiosk Mode tablet takes the **Manage Kiosk Mode** permission on the **Roles** tab. ## Store links Each store has one link for the **mobile web app**, where leaders submit ratings and discipline on their phones with no sign-in. The scorecard link from **Embed** on positional excellence's Classic View uses the same code. Anyone holding either link can use it, so keep the printed QR code out of guests' reach. On **Organization > Set up > Team links**, set the **Discipline form password**, click **Save Password**, then **Confirm**. Change it when a leader who knew it leaves. Neither link can be changed or turned off in the product. If one leaks, email [support@levelset.io](mailto:support@levelset.io) to have the store's link replaced. See [Team links](https://docs.levelset.io/organization/team-links.md). ## Integrations On **Organization > Set up > Integrations** (Forms > Edit Forms): * **Slack:** **Disconnect** revokes Levelset's access to your workspace. * **Connecteam:** **Disconnect** removes your key from Levelset. Delete the key in Connecteam too. * **HotSchedules:** a leader runs the import from their own signed-in HotSchedules session; it is not a standing connection, and Levelset holds no password for it. ## Levi, the AI assistant Levi comes with the Deploy plan, and each person also needs Levi > Use Levi. Levi reads with the asking person's own permissions. It never changes anything on its own: it drafts a change on a card, and nothing happens until the person clicks **Confirm**, when their permission is checked again. See [Ask Levi](https://docs.levelset.io/levi/overview.md). ## Your data * Levelset is served only over HTTPS. * Every record belongs to one organization, and each request is checked against the signed-in person's organization. * Clock-in PINs are stored hashed and encrypted; integration keys are stored encrypted. * You can download PDFs of positional excellence tables and of a person's discipline history. There is no full export of your organization's data in the product. ## Report a security concern Email [andrew@levelset.io](mailto:andrew@levelset.io) with what you saw and when. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.