Security and privacy
Sessions, devices and sign-in history in Leadnote
See every browser and phone signed in to your Leadnote account, sign out a device you do not recognise, and read your sign-in history and security emails.
Every time you sign in to Leadnote on a browser or phone, that sign-in becomes a session. You can see all of your open sessions, sign out any of them, and read a history of recent sign-in attempts. Use this page when you lose a laptop, borrow a computer, or get a security email you did not expect.
Where to find it
Open Settings, then My Profile, and select the Security tab. Two cards matter here:
- Where you are signed in lists your open sessions.
- Sign-in history lists recent sign-in attempts.
Everyone can see their own. You do not need any special permission.
Your open sessions
Each row shows the device and browser, for example "Chrome on macOS", the network address, when you signed in and when the session was last used. The row for the browser you are using is marked This device. A phone running the Leadnote mobile app appears as its own row, with the app named as the browser.
Sign out one session
- Select Revoke on the row. On the row marked This device the button reads Sign out.
- Confirm. For another device the dialog is "Sign this session out?" and the button is Revoke session.
That browser or phone must sign in again. If you sign out This device, you are taken to the sign-in page.
Sign out everywhere else
Select Sign out everywhere else. The button shows how many sessions it will end. Confirm, and every other browser and phone is signed out right away while this one stays signed in. Leadnote emails you to confirm it.
Sign-in history
The Sign-in history card lists the most recent sign-in attempts on your account. Records are kept for a year. Each row has:
| Column | What it tells you |
|---|---|
| When | The date and time of the attempt |
| Result | Signed in, Wrong password, Code requested, Wrong code, Signed in with code, Locked out or Setup required |
| Method | Password, Authenticator code, Recovery code or Trusted device |
| Device | The browser and operating system |
| Address | The network address the attempt came from |
Look for wrong passwords at times you were not signing in, or for addresses and devices that are new to you. A Setup required row means your organisation asked you to set up two-factor authentication at that sign-in.
Security emails Leadnote sends you
Leadnote emails you when something sensitive happens on your account:
- Sign-in from a browser, system and network it has not seen with a successful sign-in before. Your very first sign-in does not trigger this, and neither does a trusted device.
- Five wrong passwords within 15 minutes. This email is sent at most once an hour.
- Sign-in paused after repeated wrong passwords, or authenticator codes locked after five wrong codes. Also at most once an hour.
- Two-factor turned on, turned off or reset.
- A recovery code used to sign in.
- Your password changed.
- Sessions signed out.
Treat an email about something you did not do as a warning. Change your password and review the open sessions.
When sessions end automatically
Leadnote signs you out of other sessions when:
- you change your password, unless you tick Keep my other sessions signed in;
- you finish a password reset from the email link, which signs out every session;
- someone resets your two-factor, or sets a new password for you;
- your user is deactivated.
For the steps, see change or reset your password. Browsers you marked as trusted are managed separately, see recovery codes and trusted devices.
On the mobile app
A phone session ends when you sign out in the app, when you revoke it from this page on the web, or when your password is changed or reset. The mobile app does not offer a trust option. It asks for your two-factor code at every new sign-in. Details of how the app asks for the code are in two-factor authentication.
Checking someone else
Account Owners and Managers can open a person in Users to see when they were last active, the device of their last sign-in and how many sessions they have open. This helps when you wonder whether a former staff member still has access. Deactivating the user ends all of their sessions at once.
If you cannot sign in yourself, start with I can't log in.
Frequently asked questions
How do I sign out of Leadnote on every other device?
Open Settings, My Profile, the Security tab, and select Sign out everywhere else. Every other browser and phone is signed out and this one stays signed in.
I got a new device sign-in email and it was not me. What now?
Sign out that session under Where you are signed in, change your password, and turn on two-factor if it is off. Changing your password signs out your other sessions by default.
Can I see failed sign-in attempts?
Yes. The Sign-in history card lists wrong passwords, wrong codes and lockouts as well as successful sign-ins, kept for a year.
Does signing out a phone delete data on it?
The phone is signed out and must sign in again. The mobile app clears its local copy of your data when its session ends.