Account security on OrganizeOS

Your OrganizeOS account is the key to every organization you belong to. The platform has several layers of protection built in, plus a handful of controls you manage yourself. Open Settings from your profile menu and click the Security tab (or go directly to /dashboard/settings?tab=security) to see everything in one place.

What is protected by default

Every account on OrganizeOS gets the following without any setup on your part. Encryption at rest means every message you send in a channel, DM, or group is encrypted before it lands in the database. The platform decrypts it when you read it in the app, but a server breach or stolen backup returns ciphertext, not plaintext. Session security means every active sign-in is tracked and visible to you, and any sign-in from a device you haven't used before triggers an email to your account address so you find out right away. Login history records the last 25 successful sign-ins with the device, browser, and IP address so you can audit them at any time.

What you control

Four controls live on your Security tab:

Two-factor authentication is optional for most members, but always required for organization owners and admins. Some organizations also require it for their staff, sometimes with a grace period before it's enforced. When enabled, signing in asks for a six-digit code from an authenticator app in addition to your password. You also get recovery codes to use if you lose access to your authenticator. See two-factor authentication for setup.

Active sessions lists every device currently signed in to your account. You can sign out a single device (useful if you forgot to log out on a shared computer) or sign out everything except the current device. See active sessions and login history.

Recent sign-ins is the read-only log of your last 25 sign-ins. Each entry shows the device, browser, IP address, and how the sign-in happened (password, magic link, or single sign-on). New-device sign-ins are flagged with a badge.

Recovery codes appear after you enable two-factor authentication. These are single-use codes you store somewhere safe (a password manager) to get back in if your authenticator is unavailable. Using one resets your factor, so you'll set up a new authenticator afterward.

What your organization may require

Organizations can configure account-security settings that apply to all their members. The most common ones are required two-factor authentication for owners and admins (always on), and an idle-session timeout that signs you out after a period of inactivity. If you belong to more than one org and they have different idle timeouts, the shortest one applies on your device. If a setting looks new, your org's admins set it.

What is NOT protected

OrganizeOS protects against external attackers, casual database browsing, and stolen backups. It does not protect against someone with legitimate access to your account (anyone who has your password and your second factor) and it does not protect against the platform itself, which can decrypt your messages with the master key for moderation review or in response to a legal request. For conversations where you need true end-to-end encryption, where even the platform cannot decrypt, use Signal or Matrix. See message privacy for the full picture.

Why this matters

Security on a platform like OrganizeOS is not a single setting; it is the combination of the platform's defaults, your own controls, and your organization's policies. Knowing where each of those lives is the difference between "I think it's set up" and "I can show you exactly what is protecting this account." Your Security tab is the source of truth.