Account security

Passkeys, new-device alerts, changing your sign-in email, connected accounts, and your data rights on MerkatoHQ.

Your MerkatoHQ account holds your order history and moves real money, so it is worth securing well. Everything below lives under Settings → Security.

If you think someone else has access

The top of the Security page has the three steps, in the order that matters:

1. Sign out of every other device. This ends every session except the one you’re using.
2. Change your password. Do this second. Changing it first would leave the other session alive long enough to see the new one being set.
3. Review connected accounts. Anything linked here can sign in to your account.

We will never email, message, or call you asking for your password. If someone has, report it.

Checking whether an email really came from us

Settings → Notifications → Emails we’ve sent you lists every message we’ve sent to your account. If an email claiming to be from MerkatoHQ isn’t in that list, we didn’t send it.

Use this rather than the email itself. A convincing fake of our payout-account alert is the most valuable email anyone could forge against a seller, so the check has to be one you make inside the site, never by clicking a link in the message you’re unsure about.

We store the subject, the address it went to and whether it was delivered. We do not store the contents: most of our emails contain a one-time sign-in link, and keeping those on file would turn the list into a set of keys to your account.

Passkeys

MerkatoHQ supports passkeys, so you can sign in with your device’s fingerprint, face, or screen lock instead of a password. Passkeys can’t be phished or reused across sites, so they are the strongest option we offer. You can register more than one (for example, your phone and your laptop) and remove any you no longer use.

New-device alerts

When your account is accessed from a device we haven’t seen before, we send a new-device alert. If it wasn’t you, that’s your signal to sign out other sessions and review your security settings.

Changing your sign-in email

Under Settings → Security → Sign-in email, enter the new address and your current password. We then email a confirmation link to the new address, and nothing changes until you click it.

Two things happen deliberately:

• Your old address is told immediately. If a request appears that you didn’t make, someone is signed in to your account. Change your password straight away.
• Confirming signs out every device, including the one that made the request.

The link expires after an hour. For a week afterwards we keep sending security alerts to your previous address as well, so a takeover can’t quietly cut you out of your own warnings.

Connected accounts

You can link supported sign-in providers to your account for faster login. Connected accounts are managed under Security, where you can link or unlink them at any time.

Your data rights

MerkatoHQ gives you direct control over your personal data:

• Export: download a copy of your account data.
• Erasure: request deletion of your account and associated personal data, subject to records we’re legally required to retain (for example, transaction records for tax purposes).