Security
The organisation's security settings, found under Settings → Administration → Security. Today: how long people stay signed in, decided by where and how they signed in.
Your own sign-in security — Face ID and fingerprint sign-in on your devices — is a separate page for every member: Security under My Settings. Owners see both.
The page is organised in sections, one per security concern, with a single Save at the top that saves them all. Today there is one section.
Session Lifetime
A session is what starts when someone signs in and ends when they sign out, are signed out, or their session runs out. This page sets when it runs out, with one policy for each combination of where the sign-in happened and how:
| Row | Applies to |
|---|---|
| Web · Email & password | A browser session opened with an email and password. Typically administrators at a desk. |
| Web · PIN | A browser session opened by PIN. |
| Mobile · Email & password | The installed app (Android or iOS) signed in with an email and password — including a Face ID or fingerprint sign-in, which stands in for the password. |
| Mobile · PIN | The installed app signed in by PIN — the shared device. |
Someone allowed both methods is governed by the one they used for the session in hand. Switching organisation starts a new session under that organisation's policy.
The two modes
- Stay Signed In for a Period
- The session ends a set time after sign-in, whatever the person is doing. From 1 hour to 90 days. Use it to put a ceiling on how long any session can live.
- Sign Out After Inactivity
- The session ends once nothing has happened for the set time. Every touch, key or scroll moves the deadline forward; time with the app in the background counts as inactivity. From 1 minute to 30 days. Use it on a shared device, so the next cashier cannot carry on as the last one.
Enter the amount in minutes, hours or days; the sentence under each row reads the policy back. Every organisation starts with sign out after 30 days of inactivity in all four rows, which is exactly how the platform behaved before this page existed.
What happens when a session runs out
- The app signs the person out on the device the moment the policy says so, whether or not there is a connection, and the sign-in screen says why: "You were signed out after 15 minutes of inactivity, as your organisation's policy sets", or "Your session ended after 8 hours".
- The server applies the same policy every time a session refreshes its tokens, which happens in the background about every 15 minutes, so a device that was switched off is also refused when it next asks.
- Anything waiting to sync on the device is kept. It is sent the next time that person signs in online; see Working offline.
- A session opened offline by PIN follows the Mobile · PIN policy as it was when the device last connected.
When a change takes effect
Save saves every section at once and records the change in the audit log. New sign-ins follow the new policies immediately. Sessions already open pick them up at their next background refresh, within about 15 minutes; a session is never cut off at the moment you press Save, including your own.