A few specifics, since this account controls money:
Separate identity. Partner accounts are not employer console accounts and not candidate accounts. A partner session cannot open the admin console or read candidate personal data. Signing in as a partner grants exactly the partner surface, nothing else.
Sessions. The cookie holds 32 random bytes; only its hash is stored server-side. Sessions last 30 days and can be ended by signing out.
Passwords are at least 10 characters and hashed with bcrypt. We cannot read yours.
Rate limits apply to signing in, signing up, verifying codes, resending codes, saving payout details and support requests, so an attacker cannot grind through guesses.
Payout changes from an unrecognised location need your security answers.
If you think someone else has your password, change it and raise a support request from your dashboard immediately.
The partner help centre covers attribution, the ledger, payouts and the selling rules.