Sessions and devices

Processing emails

Settings lets you turn upload result emails on or off for your account. They are on by default. Web uploads made within two minutes of each other form a batch. Once every document is finished, you receive one email with succeeded, needs review, and failed counts and a link to Documents. API and email uploads do not use this notification.

How long a session lasts

A session lasts up to 30 days, refreshed automatically at most once a day while you're active. If a browser goes genuinely untouched for 30 days, that session expires on its own: you don't need to do anything.

Account status reads

Account status reads allow 180 requests per session and 600 per IP address each minute. These limits are separate from sign-in attempts. Excess requests receive HTTP 429 with Retry-After. The IP limit applies before session lookup. The session limit uses the resolved session identity before reading businesses and account protection.

Viewing your sessions

In Dashboard, open Settings, then Security. Sessions and devices lists every device currently signed in, with its approximate location (IP address) and when it was last active. The device you're using right now is marked.

Signing out one device, or everywhere else

• "Sign out" next to any OTHER device ends that session immediately, it's invalidated server-side, not just told to forget the cookie.
• "Sign out all other devices" ends every session except the one you're using right now.
• Changing your password automatically signs out every other session, as a safety measure.

Step-up re-authentication

A handful of sensitive actions ask you to re-confirm your password, a two-factor code, a passkey, an emailed code for a passwordless account, or linked Google sign-in first, if it's been more than 10 minutes since you last did: creating or revoking an API key, rotating a webhook secret, turning off two-factor authentication or removing a passkey, changing your email or password, deleting your account or organization, exporting your data, changing billing, and connecting a bank account. This is separate from your session's own 30-day duration: it protects against someone using a device you left signed in and unlocked.

Passkey verification requires biometric or PIN verification and a single-use challenge bound to the account and browser session that requested it, expiring after five minutes.

Passwordless accounts can request a six-digit code at their verified email address using POST /app/api/auth/step-up/email, then submit emailCode to POST /app/api/auth/step-up. Codes are single-use, hashed, expire in 10 minutes, and allow five attempts in the requesting session only. You can request three codes per 10 minutes; a new code replaces the previous one. Google cannot force a fresh sign-in: its verification works only with a fresh auth_time, never token issuance time. Use email or a registered passkey if Google cannot complete verification. Verification applies to this browser session for 10 minutes. Other sessions do not become verified.

Security activity

In Dashboard, open Settings, then Security. Security activity lists your own sign-ins, password and two-factor changes, passkey changes, data exports, share-link creation and revocation, and account deletion requests, newest first, in plain English. It only ever shows your own actions, never a teammate's, even in the same organization. An organization's owner or admin has a separate, broader audit log for the whole team on the Team page.

New-device notice

The first time your account signs in from a browser it hasn't seen before, you get an email with the time, IP address, and device. If that wasn't you, sign in and review your sessions and password right away.

Cookies

The dashboard sets exactly one cookie to keep you signed in (__Host-arkrel_session in production): HttpOnly (page scripts can't read it), Secure, and SameSite=Lax. It is never used for advertising or cross-site tracking.