GSM Grow
Log in Get a license

SECURITY

Your shop holds money. Here is how it's protected.

Customer wallets, supplier balances and payment keys all live in your store. GSM Grow protects them by default and gives you one page to see and change every setting.

Security CenterAll clear
Money movementRunning
Waiting for approval1
Staff with two-step sign-in3 of 3
Your security PINSet
Pause all money movement

Two-step sign-in

Authenticator app or email code, for staff and customers.

Second-admin approval

Big wallet credits and debits need another admin’s OK.

Encrypted keys

Payment and supplier keys are stored encrypted, never shown again.

One pause switch

Stop all money movement at once if something looks wrong.

EVERY LAYER

What's protected, and how

Everything below is built in. Turn on the extras in Security Center.

Sign-in and accounts

  • Two-step sign-in with an authenticator app or an email code, for staff and customers
  • Accounts lock after too many wrong passwords
  • An alert when someone signs in from a new IP
  • A bot check after failed sign-ins, and an IP block list
  • Freeze one account to stop its sign-in, API and orders

Staff and permissions

  • Roles with only the permissions each person needs
  • Password asked again before sensitive actions
  • A separate security PIN for money actions
  • An activity log of every admin change

Money

  • Large wallet credits and debits need a second admin. A store with one admin skips this; its limits still apply
  • Daily limits on transfers, per customer and store-wide
  • Optional night mode that pauses money movement during set hours
  • One switch to pause all money movement at once
  • A money log of every credit, debit and transfer that cannot be edited

Orders

  • Every paid order gets a risk score with reasons you can read
  • Orders above your threshold wait before a supplier is charged or a code goes out
  • Reject one and its IMEI or email can go on a block list

Keys and data

  • Payment and supplier keys are stored encrypted
  • Saved keys are never shown again in the admin; leave the box empty to keep them
  • Customer API keys are hashed, with IP allow-lists and request limits
  • Everything stays on your own hosting

Grow Bot and AI apps

  • Grow Bot has the same permissions as the staff member using it
  • Changes show a preview and run only after Allow
  • Refunds, wallet credits and security settings from outside AI apps wait for staff approval
  • Keys and codes are masked before any AI sees a result

Backups before every update

One-click updates take a backup first, so you can go back if something looks wrong.