Sessions and sign-in security
This page covers how long a Tidehawk session lasts, what ends one, and how to reset a password.
How long you stay signed in
Section titled “How long you stay signed in”A session lasts a maximum of 7 days. Settings → Security records this as “Session timeout: 7 days rolling”. Your session is re-checked against the database on every request, so a change made by an admin takes effect on your next page load rather than a week later.
What signs you out
Section titled “What signs you out”- Being removed from the workspace. Access ends within seconds, not at the end of the 7 days.
- Completing a password reset. Every session belonging to that account ends, on every device.
- An administrator ending all sessions for the workspace.
- Reaching the 7-day limit.
A role change does not sign you out. Your new permissions apply from your next request.
If a brief database problem stops the check from running, your session is kept rather than dropped, and the check runs again on the next successful request.
Multi-factor authentication is required
Section titled “Multi-factor authentication is required”Every member must hold a passkey or an authenticator app before they can use the workspace. Until then, every page and API call is redirected to the Secure your account screen. See Two-factor authentication.
Rate limits on sign-in
Section titled “Rate limits on sign-in”Tidehawk throttles the sign-in page to make password guessing impractical.
| Action | Limit |
|---|---|
| Sign-in attempts from one IP address | 10 per minute |
| Sign-in attempts against one email address | 5 per minute |
| Password reset requests for one email address | 3 per hour |
| Password reset requests from one IP address | 10 per hour |
| Recovery code attempts from one IP address | 10 per hour |
Exceeding a sign-in limit returns “Too many attempts”. Wait a minute and try again.
Tidehawk gives the same answer whether or not an account exists, and spends the same amount of work on both, so the sign-in page cannot be used to discover which addresses are registered. Failed sign-ins are written to the audit log so repeated attempts are visible to you.
Reset a password
Section titled “Reset a password”- On the sign-in page, choose the forgotten-password link.
- Enter your email address.
- Open the email and follow the link.
- Choose a new password of at least 12 characters.
The reset link is valid for 15 minutes and works once. The page always says a link has been sent if an account exists, whether or not the address is registered.
Completing a reset signs you out everywhere. Both the request and the completion appear in the audit log.
Secure your account
Section titled “Secure your account”Secure your account is the page Tidehawk shows when your account has no second factor. It offers a passkey or an authenticator app, and there is no way past it other than completing one or signing out. After you finish, Tidehawk issues ten one-time recovery codes and shows them once.
This gate also applies to members who joined by invitation, so a new colleague cannot use the workspace with a password alone.