Keeping the account safe

There is no separate security screen to configure. 3 things do the work: your password, signing out, and reading the activity log.

How a session works

Signing in creates a session in that browser, and it lasts 24 hours of inactivity. Using the app extends it, so a session you keep working in keeps going. Leave it alone for a day and it ends, and you sign in again.

Every browser and every device gets its own session, and they are independent. Signing in on your phone does not end the one on your laptop, and signing out of one leaves the others alone.

Signing out

Use Sign out at the bottom of the account menu in the sidebar. That ends the session in the browser you are using and takes you back to the sign-in screen.

There is no list of your active sessions to look through, and no button that names a device. Ending sessions somewhere else is done with your password, which is the more reliable tool anyway, since it also stops whoever has it from signing in again:

• Change your password to end every other session and keep the one you are in. This is the one to use for a laptop you left somewhere or a colleague who has left.
• Reset your password to end every session including your own. This is the one to use if you think somebody has your password.

When access is removed

If your account is suspended, every session on it ends immediately rather than waiting to expire, and signing in stops working. The same applies when someone who administers the location removes your access. In both cases the app does not explain who did it or why, because that is a conversation for the person who did it rather than a message on a login screen.

Nothing you built disappears when this happens. Your rules, agents and replies stay in the location and keep belonging to it.

If you think somebody else got in

In this order:

1. Reset your password. That ends every session on the account, including theirs, and stops the credentials they have from working.
2. Read the activity log. Open Activity and look for actions you did not take: sources connected or disconnected, rules created or switched on, team members invited, settings changed.
3. Check Sources. A source you do not recognize, or one that has quietly lost access, is worth explaining before you move on.
4. Check your team. An invitation you did not send is the thing worth finding fastest.
5. Check Automation. A rule that replies or sends private messages is the part of this product that could speak in your name, so read the list and confirm every live rule is one you meant.

Then tell support@reviewcomet.com. Say roughly when you think it started and what you found, and we can look from our side.

Sensible habits

• Give each person their own account rather than sharing one. A shared account cannot be signed out of selectively and cannot tell you who did what.
• Give people the smallest role that lets them work. Roles are set per person and can be limited to certain locations.
• Remove people the day they leave, rather than the day someone remembers.
• Keep the account email address one you will still control in a year. It is where password resets go.
• If you sign in with Google, Microsoft or Facebook, the strength of that account is the strength of this one. 2FA there protects this too.