8.4. User Security

User security has two parts: staff who act with care, and the right use of the security tools in Ritapos. This lesson covers both under four headings.

8.4.1. Basic cybersecurity training for staff

The Personal Data Security Guide of the Turkish Personal Data Protection Authority (KVKK) lists training and awareness work among the administrative measures for data security. Everyone who uses Ritapos at the till, on the floor or in the kitchen touches customer and business data. A short training is as important as the technical measures.

Give the training when people start and repeat it at regular intervals. We suggest covering these topics:

• Use a strong password that is different for each account. Do not write the password on paper and leave it next to the till.
• Never share a password. Do not ask for someone else's password, even as a manager.
• Change the password at once if you think someone else knows it or after a data leak. The KVKK guide also recommends changing passwords at regular intervals.
• Turn on two-factor authentication. The steps are in 2.2. Sign In with the Business Owner Account.
• Recognize phishing: unexpected links, attachments, urgent payment or password requests. Report a suspicious message to the manager without opening it.
• Sign out or lock the screen when you leave a shared computer. The screen lock is covered in the Screen Lock course.

8.4.2. Making sure every user has their own account and password

Make sure everyone who uses Ritapos in your business has their own user with a suitable role and that passwords are not shared.

• Create a separate user for each employee (8.1). Do not use a shared "till" or "waiter" account.
• Transaction logs show the user who did each action (Transaction Logs). With a shared account you cannot tell who did what.
• Choose the role by the person's job. Do not give everyone the highest permissions.
• Each user can change their own password with Profile settings > Security > Change password.
• Deactivate or delete a leaving employee's user on the same day (8.3).

8.4.3. A user's access history

Access history shows when, from which IP address and from which device the account was signed in. It opens from two places:

• For your own account: Profile settings > Security > Access history.
• For another user: Actions > Access history in the user's row in User accounts. Users with permission to manage users see this option.

The list has the columns Created at, IP, Browser, OS, Device and Login type. A row is added for each new sign-in. You can export the list with Copy, Excel, PDF and Print.

If you see a device or IP address you do not recognize, change the password and end the sessions on other devices with the steps below.

8.4.4. Signing a user out of other devices

For your own account: click Logout from other devices in Profile settings > Security. Your sessions on all devices except the one you are using end.

For another user: deactivate the user with Actions > Deactivate. The user's sessions on all devices end and the user cannot sign in again. If you think the account is compromised, set a new password with Change password. Then allow the user to sign in again with Activate (8.3).

Sources

• Turkish Personal Data Protection Authority (KVKK). Kişisel Veri Güvenliği Rehberi (Teknik ve İdari Tedbirler) (Personal Data Security Guide, Technical and Administrative Measures). Publication no. 72, in Turkish. kvkk.gov.tr
• Turkish Personal Data Protection Authority (KVKK). Veri Güvenliğine İlişkin Yükümlülükler (Data security obligations), in Turkish. kvkk.gov.tr
• NIST (2024). SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program. csrc.nist.gov
• NIST (2025). SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management. csrc.nist.gov
• CISA. Use Strong Passwords. cisa.gov
• CISA. Turn On MFA. cisa.gov
• CISA. Recognize and Report Phishing. cisa.gov
• NCSC. Small organisations guide to cyber security. ncsc.gov.uk
• NCSC. Top tips for staying secure online. ncsc.gov.uk