Sessions and security policy

Your sign-in is a session — a record on our side that says this browser, on this device, is you. This page states the session policy explicitly: how long a session lives, where you can see every device you're signed in on, how to kill one you don't recognize, and how a workspace owner or admin can require two-factor authentication of the whole team.

Session lifetime

• A session lasts 7 days, sliding: using MentionFlow extends it (at most once a day), so an active browser stays signed in and an abandoned one expires within a week.
• Sessions are stored server-side and each records the IP address and browser it was created from — that's what the devices list shows you.
• For a few sensitive operations, MentionFlow requires a fresh session (signed in within the last day) and may ask you to sign in again.
• Completing a password reset revokes every session on the account, everywhere.
• For performance, a signed cookie carries your session between full checks; it is re-verified against the server at least every 5 minutes. Sessions you revoke from the devices card don't get those 5 minutes — revocation there takes effect on the revoked device's very next request.

Devices and sessions

Your account → Devices & sessions lists every active session: device and browser, IP address, when it signed in, and when it was last active.

• Revoke any session you don't recognize — it is signed out immediately.
• Sign out other devices revokes everything except the browser you're using.
• Revoking the session you're currently on signs you out here, too (the button says so).
• Every revocation is recorded in the workspace audit log.

Requiring two-factor authentication of every member

A workspace owner or admin can require 2FA of all members: Settings → Workspace → Security.

• To turn the requirement on, you must have two-factor authentication enrolled on your own account first — the switch refuses otherwise, so the person holding it can't lock themselves out.
• The card shows who is enrolled and names the members who aren't — exactly the people the policy will stop.
• Once on, a member without 2FA is blocked from the workspace's data — pages, exports, and actions all treat the workspace as out of reach — and is walked into enrollment at their next request. Nothing is deleted; access returns the moment they enroll.
• The block is enforced server-side, not by a screen you can navigate around.
• Members who signed up with Google or Microsoft and never set a password enroll without one. The password step only appears on accounts that have a password.
• Turning the policy on or off is written to the audit log (workspace.require_2fa_changed), as is every sign-in, failed sign-in attempt, and 2FA attempt on member accounts.

Limits

• Session lifetime is fixed policy today — there is no per-workspace session-length setting.
• The require-2FA policy applies to every role, owners and admins included.
• Signing out normally (the menu) ends only the current session; use the devices card to end others.