Administration
Security settings
Password rules, sessions and the controls available to an account owner.
Open this in the appWhat you control
- Password strength requirements and expiry.
- Session lifetime and whether concurrent sessions are allowed.
- Failed sign-in lockout thresholds.
- Which email domains may be invited into the account.
What we handle
Passwords are stored hashed, never recoverable. Sessions use short-lived access tokens with rotating refresh tokens, and reuse of a refresh token invalidates the whole family — a stolen token stops working the moment the real one is used.