# Registration, login and privacy

Customers

How people become customers and sign in is set in one place: **Settings → Customer settings**. It has four tabs - **Customer**, **Security**, **Customer form fields** and **Address form fields**.

![Customer settings, Customer tab: registration method Standard, customer name format, switches for notifications, e-mail changes, account export and deletion, and the tabs shown in My account](https://grandnode.com/Plugins/Theme.GrandNodeCom/Content/kb/customers/customer-settings.webp)

Settings → Customer settings.

### Registration method

| Method | What happens |
|---|---|
| Standard | The account is active as soon as the form is sent. |
| Email validation | The customer must click a link in an activation e-mail first. |
| Admin approval | A staff member activates the account (set **Active** on the customer). Use it for B2B shops. |
| Disabled | No new registrations; guest checkout may still be allowed in the Sales settings. |

Other switches on the same tab: **Notify about new customer registration** (an e-mail to you), **Allow users to change email**, **Usernames enabled** (sign in with a user name instead of e-mail), **New customer has a free shipping for the first order**, and which tabs of **My account** are hidden (downloads, auctions, reviews, courses, documents...).

### Passwords and sign-in security

The **Security** tab:

| Setting | What it does |
|---|---|
| Regular Expression for password validation | The password rule, for example a minimum length and a digit. The message shown to customers explains it. |
| Default password format | How new passwords are stored. Keep the hashed default; never store clear text. |
| Unduplicated passwords number | How many previous passwords cannot be reused. |
| Password lifetime | Days after which a customer must change the password (0 = never). Applies to customer groups that enforce it. |
| Maximum login failures, Lockout time | After this many wrong passwords the account is locked for the given minutes. Slows down password guessing. |
| Password recovery link. Days valid | How long a "forgot password" link works. |
| Two factor authentication enabled, type | Lets customers protect their account with a second factor - an authenticator app, or a code by e-mail or SMS depending on the plugins installed. |

External sign-in with Google or Facebook is provided by the authentication plugins under **Plugins → External authentication methods**.

### Privacy: customers' own data

- **Allow users to export account** adds a button in My account that downloads the customer's data.
- **Allow users to delete account** lets customers delete their account themselves.
- Staff can export or delete a customer's data from the customer's page in the admin.
- The newsletter box can require an explicit opt-in, and the **Newsletter box. Allow to unsubscribe** switch shows an unsubscribe option.

What customers see in **My account**:

![The storefront Customer info page in My account with first name, last name, e-mail and the newsletter option, and the account menu with addresses, orders, returns, loyalty points and reviews](https://grandnode.com/Plugins/Theme.GrandNodeCom/Content/kb/customers/storefront-account-info.webp)

My account → Customer info.

### Tips and common mistakes

- With **Email validation**, make sure outgoing e-mail works first ([message templates and e-mail accounts](https://grandnode.com/docs-content)), or nobody can finish registering.
- Changing the password rule does not affect existing passwords until they are changed.

### Related

- [Customer and address attributes](https://grandnode.com/customers-customer-attributes)
- [Configuration](https://grandnode.com/docs-configuration)

- [Web page](https://grandnode.com/customers-registration-login-and-privacy)