# Security settings

There is one security action you can take on your own account, and it is the one that matters: sign out of every other device. Beside it the account screen shows how you are authenticated, when you last signed in, and every session you currently hold. There is no password to change, because there is no password.

- **Status:** Available
- **Audience:** both
- **In the app:** #/account
- **Last verified:** 2026-09-10
- **Canonical:** https://connectbyjbrh.com/docs/account/security-settings/

## What the screen shows

**How you are authenticated** — Whether this session was established with Google. There is no other method to distinguish it from.
**When you last signed in** — Taken from the newest live session rather than from a separate log, so it cannot disagree with the list below it.
**How many sessions are live** — The count of unrevoked, unexpired sessions for you, across every device.
**The sessions themselves** — One row each: a short identifier, a device description read from the browser's own user-agent string, when it started, when it was last used, and which one you are reading this on.

Everything there is a stored row. Nothing is inferred, and nothing is aggregated into a score, because a security screen that summarises is a security screen you cannot check.

## Ending other sessions

1. Open the account screen on a device you are holding.
   - Result: The session you are using is marked, so you can see which one is about to be kept.
2. Choose to sign out of other devices.
   - Result: Every session for you except this one is revoked immediately. The count of how many were ended is recorded with the action.
3. Check the list again.
   - Result: It should hold one row: this one. A row you still do not recognise after that is worth reporting rather than explaining away.

> **Note** It never revokes the session you are using. That is deliberate: a control that signs you out while you are using it reads as a bug whatever it is called, and people stop using controls they think are broken.

## After a lost or stolen device

1. Sign out of other devices, from any device you still hold. This is the fastest step and it does not need the missing device to cooperate.
2. Secure the Google account itself. Connect's session is one credential; your Google account is the thing that can make new ones, and only Google can protect it.
3. Read the session list again once both are done. It should show only devices you hold.
4. Check the decision log for the period the device was out of your control. It records actions and refusals with the person behind them, which is how you establish whether anything was actually done rather than merely possible.
5. If a mailbox or another provider credential may have been exposed on that device, rotate it at the provider. Connect seals what it stores and never shows it back to a screen, but a credential typed on a device is a credential that device saw.

> **Careful** Ending sessions does not undo anything already done. Messages that were sent are sent, and approvals that were given stand. The decision log is where you find out which of those happened, and it names the account rather than the device.

## What Connect does not offer, and why

| Control | Status here | Where it lives instead |
|---|---|---|
| Password change | Does not exist | There is no password. Google sign-in is the only route in |
| Two-step verification | Not in Connect | Your Google account, which is what actually authenticates you |
| A lock screen | Does not exist | Signing out, which ends the session rather than covering it |
| Revoking one named session | Not offered | Sign out of other devices ends every one but this, which covers the case that matters |
| An access history | Not offered as a list | The decision log, for what was done; the session list, for what is live now |

The pattern is consistent: a control appears here only if it changes something real. Everything else is either Google's job or a switch that would give false comfort.

## Questions

### Can an administrator sign somebody else out?

Not from this screen — it acts on your own sessions. Deactivating a user stops their next request resolving to an identity, which has the same practical effect and is an administrative action rather than a personal one.

### Does signing out of other devices affect my colleagues?

No. It ends sessions belonging to you, wherever they are. Other people's sessions in the same workspace are untouched, because a session belongs to a person and a browser rather than to the workspace.

### How do I know nothing was done from the missing device?

Read the decision log for that period. Every action and every refusal is recorded with what decided it and who. A quiet log for those hours is real evidence; an empty session list afterwards only proves the access is closed now.

## Related

- [Account and access](https://connectbyjbrh.com/docs/account/)
- [Sessions](https://connectbyjbrh.com/docs/account/sessions/)
- [Signing in as somebody else](https://connectbyjbrh.com/docs/account/session-replacement/)
- [Signing in with Google](https://connectbyjbrh.com/docs/account/google-sign-in/)
- [Reviewing account security, end to end](https://connectbyjbrh.com/docs/workflows/account-security-review/)
- [How provider credentials are stored](https://connectbyjbrh.com/docs/security/credential-sealing/)
- [The decision log](https://connectbyjbrh.com/docs/autonomy/audit-trail/)

## What this page is based on

- Connect source pack §10 — Google-only sign-in and sealed provider credentials (`docs-source/sources/GENERAL.md`)
- `backend/app/main.py` — the account payload's security block and the revoke-others action that never ends the caller's own session
- `backend/app/app_auth.py` — session revocation and the live-session list