Skip to main content

10. Your secure session

Your sign-in works like this:

  • A session lasts 4 hours.
  • While you are active, it is refreshed about every 15 minutes.
  • Some actions need a fresh sign-in. Your sign-in counts as fresh for 5 minutes. After that, you must sign in again to approve money or make a committee decision.
  • Important actions are recorded in the audit trail.

The "Secure session" card. The footer of every staff page shows one of two messages:

  • MFA enrolled · Secure session active: two-step security is set up.
  • Authenticated session · MFA not enrolled: you are signed in, but have not set up two-step security.

Always enforced, whatever the policy

The following actions need two-step security and a fresh sign-in, even when the staff policy is off:

  • Approving, rejecting, reversing and refunding money transactions.
  • Recording scheme money (contributions and payouts).
  • Generating report exports.
  • Opening financing cases, high-risk case changes and committee decisions.

Profile page. Open My profile from the profile menu. It shows Verified staff identity (your name, email, organisation, membership and roles), Account security (two-step security, passkeys, trusted devices and session), Recent sessions, and buttons Notification centre and Review security settings.

Common problems

  • "Session expired". Sign in again. This is normal after four hours.
  • An action asks you to sign in again. Your last sign-in is too old for this action. Sign in again, then repeat the action.
  • You see an unknown session in Recent sessions. Sign out of that session from your profile, then change your password (section 9).