Sessions and security policy

Your sign-in is a session. It is a record on our side that says this browser, on this device, is you.

Session lifetime

• A session lasts 7 days, sliding. Using MentionFlow extends it, at most once a day. So an active browser stays signed in and an abandoned one expires within a week.
• Sessions are stored server-side. Each records the IP address and browser it was created from. That's what the devices list shows you.
• For a few sensitive operations, we require a fresh session, signed in within the last day, and may ask you to sign in again.
• Completing a password reset revokes every session on the account, everywhere.
• For speed, a signed cookie carries your session between full checks. It is re-verified against the server at least every 5 minutes. Sessions you revoke from the devices card don't get those 5 minutes. Revocation there takes effect on the revoked device's very next request.

Devices and sessions

Your account lists every active session on the Devices & sessions card: device and browser, IP address, when it signed in, and when it was last active.

• Revoke any session you don't recognize. It is signed out immediately.
• Sign out other devices revokes everything except the browser you're using.
• Revoking the session you're currently on signs you out here too. The button says so.
• Every revocation is recorded in the workspace audit log.

Requiring two-factor authentication of every member

A workspace owner or admin can require 2FA of all members on Security.

• You must have two-factor authentication enrolled on your own account first. The switch refuses otherwise, so the person holding it can't lock themselves out.
• The card shows who is enrolled and names the members who aren't. Those are exactly the people the policy will stop.
• Once on, a member without 2FA is blocked from the workspace's data. Pages, exports, and actions all treat the workspace as out of reach, and the member is walked into enrollment at their next request. Nothing is deleted. Access returns the moment they enroll.
• The block is enforced server-side, not by a screen you can navigate around.
• Members who signed up with Google or Microsoft and never set a password enroll without one. The password step only appears on accounts that have a password.
• Turning the policy on or off is written to the audit log (workspace.require_2fa_changed). So is every sign-in, failed sign-in attempt, and 2FA attempt on member accounts.

Limits

• Session lifetime is fixed policy today. There is no per-workspace session-length setting.
• The require-2FA policy applies to every role, owners and admins included.
• Signing out normally, from the menu, ends only the current session. Use the devices card to end others.