What this is, and who it is for
Settings is the one page every signed-in person has. It shows who the system thinks you are, how you sign in and how the system protects your account, and where you are signed in, with a way to end any other sign-in. Nothing on the first two tabs can be changed: every figure is a value the server enforces, read from your session, the same for everyone, and shown so that you can rely on it. There is no permission to hold; the page is open to every signed-in person.
Where to find it
Administration → Settings. It has two tabs, Account and Security and policy; Where you are signed in → opens the sessions page.
What you can do
Read your account
Your account shows your name and email, as the system holds them. They are kept by your organization's administrator, who can change them; there is no form to change them yourself.
Read how you sign in
Security and policy → How you sign in has five rows, each marked set by deployment (fixed for everyone). With the standard settings they read:
| Row | What it says |
|---|---|
| Sign-in method | One-time code sent to your address. There is no password. |
| Code | 6 digits, valid for 5 minutes, 3 attempts for each code. A new code can be asked for after 60 seconds; at most 3 codes for one account from one address in 15 minutes. A wrong code locks no one out: it spends an attempt, and the next code is a new request. |
| Inactivity sign-out | After 15 minutes without activity you are signed out. You are warned 2 minutes before. |
| Longest session | A session ends after 12 hours whatever you were doing. |
| Electronic signatures | Every signature needs a fresh code that is valid for that record and that meaning only, and your typed name. |
The figures come from the server (/auth/me), so the page cannot say anything that is not so; a deployment may set the inactivity and session times differently (SESSION_IDLE_TIMEOUT_MIN, SESSION_ABSOLUTE_TIMEOUT_MIN; Configuration). The page itself watches for activity (a click, a key, a touch): it warns you before the window ends and then signs you out and says why, so that a screen of clinical data left open on a workstation does not stay open. A browser shares one clock across its tabs.
Under Your devices, Signed in now counts your live sign-ins and when you were last active on this one.
A line at the foot lists what is not part of this release and so is not shown: single sign-on, notification channels beyond in-app and email, branding and display preferences.
See where you are signed in
Where you are signed in (The devices signed into your account now. Sign out any you don't recognise: it ends that sign-in at once.) lists your live sessions, this device first, then the others by when they were last used: Device (best-effort, such as Chrome on Windows), Place (the address the sign-in came from), Started and Last active. Your current session is marked This device.
- Sign out on another device ends that sign-in at once; it must sign in again.
- Sign out all other devices ends every session except this one.
A sign-in that was ended is not listed. Entering a UAT or Live workspace ends the session it replaces, so the list shows only what is alive now.
Every option
What counts as a session
Each sign-in, and each entry to a workspace, is a session with its own tokens. A session ends when you sign out, when you are idle for the inactivity window, when the longest-session limit is reached, when an administrator suspends or removes you from the organization, or when you end it here. A refresh token that is presented a second time is treated as possible theft: the session is ended and the event is recorded.
Signing in again
Sign-in is the page at /auth: enter your address, then the code that arrives by email (Signing in). After three wrong codes, or too many requests for codes, the page says that access is temporarily restricted and for how long.
What the system records
auth.login.succeeded, auth.otp.requested, auth.otp.failed, auth.otp.throttled, auth.otp.verified, auth.session.refreshed, auth.session.revoked (signing out, or ending a session here), auth.session.reuse_detected and, for each signature, auth.stepup.verified. See Audit events; an administrator reads them in the organization's trail (Review organization access and audit).
What you cannot do, and why
- Change your name or email. They are the organization's record of who you are, attached to everything you record; an administrator changes them.
- Set a password, a longer session or a shorter or longer inactivity time. There is no password; the times belong to the deployment, not to the person.
- Turn off the code at signing. Every signature needs its own code.
- Sign in on another person's behalf. The code goes to the address of the account.
Compliance Q&A
Yes. There is no password to share or reuse. A code is valid for five minutes, for three attempts, and is sent only to the account's address. A session ends after fifteen minutes without activity and after twelve hours at most, and the person can see and end their sessions.
Limits: possession of the mailbox is the factor; a second factor is not built. The strength of the person's email account is outside the system (Not built yet).
Evidence: server auth (one-time code, 3 attempts, 5-minute validity, cooldownsidle and absolute session limits enforcedproduction checks refuse an idle limit over 8 hours)client idle timersimulation of 20 Oct 2026 steps 2.1 and 2.4
Yes. The sessions page lists every live sign-in with device, place and last activity and ends any of them at once; each ending is recorded.
Evidence: client settings/sessions pageserver sessions list and revokeaudit event auth.session.revoked
Related
Signing in · Sign records · Settings reference · Invite and manage members · Security and hosting