# Team access and account security
Source: https://docs.webgee.com/en/wordpress-cloud/team-access









Access is managed at the organisation level. Select **Users** in the left
navigation.

<img alt="The Users and roles page, listing the owner with 2FA status" src="__img0" />

The table shows each person, their role, whether two-factor authentication is
active, and when they were added. Filter by role or search for a name.

## Invite someone [#invite-someone]

<img alt="The Invite new user form, showing the Super admin role and the invite methods" src="__img1" />

Select **Invite user**, then supply a name, an email address and an invite
method:

* **Invite with email** — an invitation is sent to the address.
* **Invite with link** — a link is shown once you select **Invite**, for you to
  pass on yourself.

The available role is **Super admin**, which has unrestricted access. The
account that created the organisation holds **Owner**.

<Callout type="warn">
  Super admin is unrestricted — it can delete websites, restore backups over
  live data and remove other users. There is no read-only or per-site role, so
  invite only people you would trust with all of that.
</Callout>

For giving someone access to a single website rather than the whole
organisation, use **Collaborators** on that website's overview page instead.

## Secure your own account [#secure-your-own-account]

Go to the account menu, top right, then **My account**.

<img alt="The My account page, showing profile, email and language" src="__img2" />

* **Profile** — display name, email address and panel language.
* **Password** — **Reset** changes it.
* **Two-factor authentication** — off by default. Turn it on; it pairs with any
  authenticator app.
* **Devices** — everything signed in or active in the last 30 days, with
  **Log out of all devices**.

<Callout type="warn">
  Enable two-factor authentication before inviting anyone else. This panel can
  delete every website in the organisation, and a password alone is the only
  thing standing in the way.
</Callout>

If you see a device you do not recognise, use **Log out of all devices** and
then change your password — in that order, so the reset invalidates the session
rather than the other way round.

## Related [#related]

* [Activity logs](/en/wordpress-cloud/activity-logs)
* [Sign in and find your way around](/en/wordpress-cloud/getting-started)