# Access control

## Accounts

Each person signs in to Kontala with their own account, invited by an admin of your organisation.
Kontala creates organisations, so there is no self-serve sign-up.

## Two-step verification

Turn on two-step verification in **Settings**, under **My details**.
Signing in then asks for a 6-digit code from an authenticator app as well as your password, and recovery codes let you in if you lose your phone.

## Roles

| Capability | Admin | Member | Viewer |
| --- | --- | --- | --- |
| See this organisation's settings | Yes | Yes | Yes |
| See the people in this organisation | Yes | Yes | Yes |
| See properties and their tracking | Yes | Yes | Yes |
| Create and archive properties | Yes | Yes | |
| Create and revoke write keys | Yes | Yes | |
| Change how tracking is configured | Yes | | |
| Make and revoke server keys | Yes | | |
| Invite and manage people | Yes | | |
| Change this organisation's details | Yes | | |

Roles carry over to Analytics.
See [Analytics security and governance](/docs/analytics/security-and-governance).

## Write keys

A write key tells Kontala which property an event belongs to.
It sits in your page source, so it is not a secret: revoking it, not hiding it, is what stops it.
See [Install the website tag](/docs/data-capture/install-the-website-tag) for how to rotate one.