Multi-Factor Authentication

ShelfSpace MFA Setup and Options

ShelfSpace MFA setup is part of every new account creation. When a user accepts an invitation and creates their account, the platform prompts them to enable multi-factor authentication before they access it for the first time. MFA adds a second verification step beyond the password, which protects your dispensary's financial data even if a password is compromised.

In cannabis, MFA is not just a best practice — it is increasingly a compliance expectation. Regulators and auditors want to know that access to financial systems, vendor payment data, and inventory records is protected by more than a password. ShelfSpace makes MFA easy to set up so your team has no reason to skip it.

MFA Methods

ShelfSpace supports two multi-factor authentication methods today. Each user can choose the one that works best for them:

• Email one-time code (default) — The platform sends a one-time code to your registered email address. Enter the code after your password to complete login. It is the default method and works for every user with no extra setup.
• TOTP (Authenticator App) — Use an authenticator app like Google Authenticator, Authy, or 1Password to generate time-based one-time passwords. You scan a QR code once during setup, and the app generates a new six-digit code every 30 seconds. This is the most secure option.

SMS text-message codes are coming soon and will be offered as an additional method in a future update.

Why MFA Matters for Cannabis Compliance

Cannabis dispensaries handle sensitive data: vendor payment amounts, bank account details, inventory counts tied to state-tracked packages, and employee access logs. A compromised account could expose all of this. MFA ensures that even if someone obtains a user's password through phishing or a data breach elsewhere, they still cannot access your ShelfSpace account without the second factor.

During audits, regulators may ask how you protect access to your financial systems. MFA is a concrete control you can point to. Combined with role-based permissions and immutable audit logging, it forms a strong security posture that satisfies most compliance frameworks.

Managing MFA for Your Team

Admins can see which users on their team have MFA enabled. If a team member loses access to their MFA method — a lost phone, for example — an admin can request a reset through ShelfSpace support. We verify the request and re-enable the setup flow for that user.

MFA is required on every ShelfSpace account — a second factor is verified on every login, so no user can access the platform with a password alone. Combined with the security infrastructure we have in place, this keeps your operation locked down without adding friction to daily workflows.