How to protect your online store on Tiendanube or Empretienda: a security checklist

Platforms like Tiendanube and Empretienda handle a lot of the security for you: the servers, the SSL certificate, the payments. What they can't take care of is how people get into your dashboard. And that's where almost every problem shows up: a reused password, a former employee who can still log in, or an unprotected email account.

This checklist is designed to be reviewed in one hour, with no technical knowledge.

Access

1. Each person with their own user account. If the team shares a single account, you don't know who did what and you can't remove access for just one person. The platforms let you create additional users: use them, and give each person only the permissions they need.

2. Remove access that no longer applies. Former employees, an agency you no longer work with, a nephew who helped you two years ago. Review the user list and delete anyone who isn't working at the store today.

3. Unique, long passwords. Your store password can't be the same as the one for another service. If one of those services is breached, attackers try the same password everywhere. A password manager (Google's, Apple's or one like Bitwarden) solves this without you having to memorize anything.

4. Two-step verification wherever it exists. If your platform offers two-step verification to log in to the dashboard, turn it on. If it doesn't, protect the email you signed up with using two-step verification, since it's the key to recovering your password.

Email: the master key

5. Your store's email is the most important thing you have. With access to that email, anyone can click "forgot my password" and take over the store, the domain and sometimes the payment account. That email needs a unique password, two-step verification and an up-to-date recovery phone number.

6. It should be in the business's name, not in the name of someone who might leave. If the sign-up email is a team member's personal account, the day that person leaves, they take the key with them.

Integrations and payments

7. Review the installed apps. Every app you connect to the store has permissions over your data: orders, customers, products. Uninstall the ones you no longer use.

8. Review the payment methods and the payout account. Go to the payment settings and confirm that the account where the money is deposited is yours. It's a silent change an intruder can make and that would take you days to notice.

If something goes wrong

9. Keep a copy of your catalog. Export your products and customers regularly (the platforms let you export to a spreadsheet) and store that copy outside the store. If something gets deleted or breaks, you don't start from scratch.

10. Know who to call. Write down today where to find support for your platform and your payment provider, and who on your team has access to what. In an incident, every minute spent looking for a phone number counts.

In summary

| What | Why | | --- | --- | | One user per person | You can remove access one at a time | | Two-step verification on the email | It's the key to recovering everything | | Review apps and payout account | They're silent changes | | Export the catalog | You're back online quickly |

If you'd like, we can review your store with this checklist and give you a report with what needs to be fixed. We also build new stores on Tiendanube, Empretienda or custom-made, set up this way from day one.