Security & Compliance
Sessions and lockout
A signed-in session ends after a fixed time, not after a period of inactivity. This page gives the exact limits, the lockout rule, how sessions are revoked, and the settings that look like they change these things but do not.
Written for: Security reviewers · Administrators
How long a session lasts
| Field or control | What it means |
|---|---|
| Absolute limit | 8 hours from sign-in. After that the next request requires signing in again, however active the user has been. |
| "Stay signed in" | A user who ticks Remember me at sign-in gets a 12-hour session instead - one working shift. Administrators always get 8 hours, ticked or not. It cannot be changed per organisation today. |
| Idle timeout | None. A session left open on an unattended screen stays valid until its absolute limit. Lock the workstation. |
| Concurrent sessions | Not limited. The same account can be signed in on several devices. |
| Session cookie | A signed token in an HttpOnly, SameSite=Lax cookie, marked Secure over HTTPS. It is re-issued every 30 minutes of activity; re-issuing does not extend the 8-hour limit. |
Failed sign-ins and lockout
| Field or control | What it means |
|---|---|
| Account lockout | 10 consecutive wrong passwords lock the account for 15 minutes. The lock applies to every sign-in method, including Google, and lifts by itself when the 15 minutes are up. A successful sign-in resets the count. Each failure and each lockout is written to the audit log. |
| Sign-in rate limit | Independently of lockout, failed password sign-ins are limited to 10 per 15 minutes for one IP address and email, and 50 per 15 minutes for one IP address. A successful sign-in does not use up the allowance. |
| Unlocking early | An administrator can unlock an account from user administration (recorded as ADMIN_ACCOUNT_UNLOCKED). A completed password reset also clears the lock. |
| Passwords | At least 12 characters with an upper-case letter, a lower-case letter, a digit and a symbol; stored as bcrypt hashes. There is no password history or expiry. |
Ending a session
| Field or control | What it means |
|---|---|
| Sign out | Clears the session cookie in that browser. |
| Force logout (administrator) | From user administration. Invalidates every session the user holds; the next request to a protected screen or action is refused. Recorded as ADMIN_FORCE_LOGOUT. |
| Deactivating a user | The user's next request is refused, because every server-side check re-reads the user's status from the database. |
| Password reset | Ends every session the user already holds, whether the reset came from an emailed link or from an administrator. An emailed reset also cancels any other reset links still outstanding for that user. |
| Changing a user's role | Takes effect on the user's next request, for the same reason as deactivation. |
What we recommend to customers
- Set workstations to lock after a short idle period; ArkCloud will not do it for you.
- Ask staff not to use "stay signed in" on shared or unattended computers.
- When someone leaves, deactivate the user and use Force logout the same day.