# Account security

You reach your CLItrail account through your Google account or your mailbox: CLItrail keeps no password of yours. Protect them with 2-step verification or a passkey, and manage CLItrail’s own sessions in **Account and security**.

## Sign-in

Every sign-in goes through Firebase Authentication, with Google or a one-time email link, and must be recent when it reaches CLItrail. The server checks the token itself and asks Firebase whether the account is disabled or its sessions revoked. See [Sign in](https://clitrail.com/docs/sign-in).

## Sessions

- A sign-in lasts 7 days, in an `HttpOnly`, `SameSite=Strict` cookie. Only a hash of the session token is stored.
- **Account and security** lists each session with when it started and was last active, updated at most every 5 minutes. Sign out one session, or every other one.
- Signing out of Google does not end CLItrail sessions already started; sign them out here.

## If someone else got in

Sign out every other session in **Account and security**, secure your Google account or mailbox, and revoke any destination credentials you are unsure of on the platform that issued them, then **Replace** them in CLItrail. Then email [founders@pilotprotocol.network](mailto:founders@pilotprotocol.network).

## Confirming who you are

Deleting your account, or an organisation that still has websites, asks you to sign in again first, even inside a session: with Google, or with a new email link. A sign-in by another account is refused (`recent_sign_in_required`).

## Delete your account

**Account and security → Delete account** removes your sessions, your support requests and your account. Organisations only you belong to are deleted with it, with their websites and data. You leave organisations shared with others; if you are the last owner of one, make someone else an owner first (`transfer_ownership_first`), and cancel any subscription of an organisation that will be deleted (`subscription_active`). What you did in shared organisations stays in their activity, without your name.

## Limits and activity

Dashboard writes are limited to 30 a minute per client address and reads to 600 a minute per session. **Security activity** lists the last 20 sign-ins and security changes on your account.