How sessions and sign-in work
Signing in
Three methods:
- Email and password
- Microsoft Entra ID
Passwords are stored hashed, never in plain text, and are never logged or emailed.
Password reset issues a single-use token with an expiry, verified before any change is applied.
Email verification issues a single-use token valid for 24 hours. Verification is prompted rather than enforced — an unverified user is not locked out, so a delayed email never becomes an onboarding wall.
Your session proves who you are, and nothing more
This is the part worth understanding, because it explains a behaviour people find surprising.
Your session cookie establishes identity only. Everything that decides what you are allowed to do — your role, your organization, its plan, whether your account is active — is read fresh from the database on every request.
The practical consequences:
- A role change applies on your next request, not at your next sign-in
- Deactivating a user ends their access immediately, even mid-session
- Deleting a user invalidates their session immediately
- A plan upgrade applies immediately — reload and the feature is there
Nobody keeps access they no longer hold because a cookie has not expired yet.
Signed out unexpectedly?
If your account has been deactivated or deleted, your session stops working immediately and the cookie is cleared. Ask your organization's Owner.
Reviewing your sign-ins
Settings → Profile shows your recent sign-ins with date, IP address, and an approximate location derived from it.
Locations are coarse — often a nearby city rather than your exact one. A neighbouring town is normal. A different country is not.
If you see something you do not recognise:
- Change your password immediately.
- Tell your organization's Owner.
Signing in on several devices
You can be signed in on more than one device at a time. The installed app on a phone and a browser on a desktop are separate sessions.
Changing your password
Settings → Profile. If you sign in with Google or Microsoft, there is no password on the account — authentication happens at your provider.
What an Owner can do
- Change roles — applies immediately
- Deactivate a user — revokes access immediately, preserves history
- Reactivate a user — restores access
On Cosmos, Microsoft Entra directory sync can deactivate users automatically when they leave your directory. See Auto-deprovisioning leavers.
Protecting your account
- Use a unique password you do not use elsewhere
- Prefer Google or Microsoft sign-in where your organization already secures those accounts
- Review your sign-in history occasionally
- Sign out on shared devices
Related articles
Need Help?
If you have questions not covered in this article, our support team is here to help.
Contact Support