Securing Your Chatbot Account: Team Roles, Two-Factor Authentication and Access Hygiene

Your chatbot dashboard holds things worth protecting: your customers' conversations and contact details, the documents that make up your knowledge base, your booking calendar and, if you bring your own key, access to an AI provider account that can run up a bill. The account that controls all this is only as safe as its weakest login. Most real-world account compromises are not clever hacks: they are reused passwords, shared logins, former staff who still have access and owners without a second factor. This guide is a practical security guide for owners of a chatbot workspace: how to set roles so people have only the access they need, how two-factor authentication works and how to turn it on, how to sign in safely, how to handle joiners and leavers, how to protect API keys, how to use an audit trail and a checklist you can complete in an afternoon.

What is at stake

The impact of a takeover is larger than most owners assume, because a chatbot sits in front of your customers.

Least privilege: give people only what they need

Roles restrict what each team member can view and change. The principle is least privilege: start with the minimum and add access when there is a reason.

• Review roles when someone's job changes.
• Avoid giving everyone owner rights for convenience.
• Use named accounts for everyone; never share a login.
• Limit who can see AI keys and who can change assistant instructions.

Crescelo workspaces use roles that restrict what team members can view, edit or change, and owners can see an audit trail of important actions.

Two-factor authentication (2FA)

A password alone can be guessed, reused from another breach or stolen. A second factor requires something else: a code from an authenticator app on your phone. Even if your password leaks, an attacker cannot sign in without the code. Crescelo supports time-based one-time codes from authenticator apps, and team accounts can require them at sign-in.

1. Install an authenticator app on your phone.
2. In the workspace's Security settings, start 2FA setup and scan the QR code.
3. Enter the six-digit code to confirm.
4. Save the recovery codes somewhere safe and offline; they let you in if you lose your phone.
5. Test signing out and back in with a code.

• Turn it on for owners first, then for everyone.
• Prefer an authenticator app over text messages, which can be intercepted.
• Store recovery codes in a password manager or a locked drawer, not in an email.
• When someone leaves, remove their access; do not rely on their 2FA.

Strong sign-in habits

• Use a unique, long password from a password manager.
• Never reuse passwords across services.
• If you sign in with Google, protect that Google account with 2FA as well.
• Be careful of phishing: check the address before entering credentials, and do not enter a code you were not expecting.
• Sign out on shared devices.

The Crescelo dashboard checks a session on every request against your account state, so changing your password or removing a member ends their existing sessions.

Joiners, movers and leavers

Write this down as a short checklist. Offboarding is where most access problems start.

Protect API keys

• Use a dedicated key for each assistant, with a spending limit at the provider.
• Never paste keys into chats, emails or website code.
• Restrict who can view or change the AI settings.
• Rotate keys when a person with access leaves or a leak is suspected.
• Crescelo stores provider keys encrypted; see how a bring-your-own-key vault works.

Use the audit trail

An audit trail records who did what and when: a setting changed, a source deleted, a member added. Use it. Review it monthly for unexpected changes, and after any incident. Owners on Crescelo can see an audit trail of workspace actions. It also helps in a dispute or an investigation, because you can see what happened.

Other basics

• Keep your devices updated and locked.
• Do not use public Wi-Fi for admin work without a trusted connection.
• Limit who has admin access to your domain and website, since the chat is installed there.
• Be careful with browser extensions.
• Back up important content, such as your knowledge documents.

If you think an account is compromised

1. Change the password and sign out everywhere.
2. Remove suspicious members and revoke API keys.
3. Check the audit trail for what changed.
4. Review recent conversations and leads for unusual activity.
5. Restore altered content from your originals.
6. Tell affected customers if their data may have been exposed, as your legal obligations require.
7. Contact support with the details.

A one-afternoon checklist

• Two owners at most, both with 2FA.
• Every team member on a named account with the smallest role.
• Recovery codes stored safely.
• Old and shared accounts removed.
• A dedicated AI key with a spending limit.
• Audit trail reviewed.
• A written joiner and leaver checklist.

Common mistakes

• Making everyone an owner because it is easier.
• Sharing one login across the team.
• Keeping recovery codes in the same inbox as the password reset email.
• Forgetting to remove contractors when a project ends.
• Never looking at the audit trail.
• Leaving the AI key visible to people who do not need it.

Fixing these takes an afternoon and removes most of the realistic ways an account gets compromised. Put a recurring quarterly reminder in the calendar to review roles and access.

Frequently asked questions

See how your data is protected and the data processing addendum, read the GDPR checklist, see SSRF protection for web scrapers, the AI assistant feature and start a free trial to set up your workspace securely.

Further reading

• OWASP Top 10 for Large Language Model Applications: The main security risks of AI assistants, including prompt injection.
• Google Search Central: creating helpful, people-first content: What Google looks for in useful pages.