GoRefer Trust Center
Access Control
Updated October 2026
About this page. This page describes how GoRefer works today. It is not an independent audit or a contractual service level. For questionnaire answers, or for documents we share under NDA, make a request through the Trust Portal.
GoRefer limits access by firm, role, client assignment and permission. Your firm's everyday work and GoRefer's own support access follow different rules, and both are logged.
Roles and Permissions
Updated October 2026
Role and permission checks run on GoRefer's servers, not just in your browser. The table shows the standard firm roles; custom permissions and client assignments can change what each person can do.
| Role | What They Can Do | Restrictions |
|---|---|---|
| Admin | Full firm access | Manage users, commission settings, billing, and all firm data |
| Preparer | Own clients & referrals | Assigned client and referral workflows, subject to firm permissions |
| Client | Client portal only | Submit referrals, check reward status, update profile |
| Agent | Recruiting pipeline | Recruiting and enrollment permissions depend on assigned role |
Your firm's data stays with your firm
Each firm's data is kept separate from every other firm's, and requests from your firm reach only your firm's data. When GoRefer support works inside your account, the session is time-limited and logged.
Two-Factor Sign-In
Updated October 2026
For your firm
Two-factor sign-in is required for firm admins, and your firm can require it for preparers. The code comes by email or from an authenticator app. A device you choose to trust can skip the code for 30 days.
Works with common authenticator apps
One-time backup codes are created when you set up an authenticator app
For GoRefer staff
GoRefer staff sign in to our administration tools with two-factor sign-in
Staff actions in those tools are logged
Sessions
Updated October 2026
Session controls
Sessions are short-lived and can be revoked
The browser extension signs you out after 24 hours
Support sessions inside your account are time-limited, logged, and blocked from certain sensitive actions
Rate Limits and Lockouts
Updated October 2026
Protection against password guessing
Sign-in, account recovery, registration and password reset have attempt limits
Repeated failed sign-ins lead to a lockout
GoRefer can block IP addresses that attack the service