App lock, sessions and the security log
Lock instead of signing out, two-step verification, every device signed in, sign out everywhere, and the record of what happened to your login.
App lock
On a phone or desktop the app locks instead of signing out when you have been away: after 30 minutes behind another window on a desktop, 5 minutes in the background on a phone, or 60 minutes of no activity in the foreground. Unlock with Face ID, Touch ID, Windows Hello, a fingerprint or your device passcode. Your session and your encryption key are kept; nothing reloads.
Account → Security → App lock:
- Lock instead of signing out — on by default wherever the device has a credential. Off means inactivity signs you out.
- Require biometrics only — the passcode will not unlock Storehouses; only an enrolled biometric will.
- Lock after — keep the background grace, or lock the moment the app leaves the foreground.
In a browser there is no device credential, so inactivity signs you out after a warning.
Two-step verification
Account → Security → Two-step verification enrols an authenticator app. Every new sign-in then needs the six-digit code as well as your password. Ten recovery codes are shown once at enrolment, with a download; keep them with your encryption recovery key, not in the authenticator they are meant to replace. If you lose the authenticator, Lost your authenticator? on the sign-in step takes one code: it turns two-step off so you can sign in, emails you, and you set it up again from Account → Security. Each code works once, and New recovery codes in Manage replaces the whole set.
Sessions
Sessions and activity lists every device signed in to your account — platform, last active, where. Sign out any one of them, or Sign out everywhere when a device is lost. Signing out does not forget your encryption key on the device's keychain unless you also turn off Lock instead of signing out; a lost device should be signed out everywhere and have its passcode changed.
The security log
Beneath the sessions, a dated log of what happened to the login itself: sign-ins and from where, password changes, two-step enrolment, encryption enabled, rotated or disabled, recovery key regenerated, people and professionals granted or revoked, share links created and deleted. It is distinct from the asset audit trail, which records what happened to the property.
Deleting your account
Account → Profile → Delete this account asks us to close the account and delete its data. We confirm in writing when it is done. Export first if you want to keep anything.