Profile and Security

Profile is your account and security center.

Use Profile for personal security questions. Use Audit for account trail, session history, and a support-safe history packet. Use Billing for plan limits, Hubs for hub setup, Connections for setup links and connection files, and Access rules for access.

What Lives Here

Profile is where your own security lives: two-step sign-in, recovery codes, and the browsers currently signed in as you. If two-step sign-in blocks something, check the authenticator app and your recovery codes before anything else. If a browser in the active list isn’t one you recognise, remove it before you go on. Plan limits aren’t here; they’re in Billing. Your last sign-ins are listed here, and the full account trail is in Audit.

Profile owns your identity and your security. The posture list says what to do next; on Free, MFA is optional and the first thing worth adding.

What You Can Manage

Name and avatar

Set a display name, choose an avatar style, and keep your profile readable for teammates.

Two-step sign-in

Enable an authenticator app, generate recovery codes, and protect private setup material.

Current devices

Review active browsers, remove old sessions, and set how long an idle browser stays signed in.

Plan summary

See hub, client, access rules, daily limits, hub address, listing, and help details.

Account data

Download a machine-readable copy of your retained account data before deleting the account.

Two-Step Sign-In

MFA is optional on the Free plan. You can start using the dashboard after email verification, dismiss the optional security reminder, and choose Set up authenticator whenever you’re ready.

If you already turned MFA on it stays on. On the Free plan you can choose Disable MFA after confirming a valid authenticator or recovery code; paid accounts follow whatever policy the account has been given. Setup links and private connection-file actions ask you to verify again whatever your MFA setting is.

Keep recovery codes somewhere safe outside Thalovant. Each code works once when the authenticator app is unavailable.

Each code from the authenticator app works once too. If a code was just used, to sign in on another device for example, wait for the app to show the next one.

After five wrong codes in a row, Thalovant stops accepting codes for your account for 15 minutes, and each wrong code after that doubles the wait, up to a day. Every place that asks for a code counts toward the same five: signing in, turning MFA off, new recovery codes and connection files. Your password keeps working, and we email you when it happens. If it wasn’t you, someone probably has your password: press This wasn’t me in that email and choose a new password, which also ends the wait.

Wrong Passwords

Wrong passwords never lock your account. After five in a row, the next sign-in has to wait a little: 15 seconds at first, doubling with each further wrong password, up to 5 minutes. A browser you’ve already signed in with on this account doesn’t wait, so someone guessing elsewhere can’t keep you out of it. The sign-in page says when it’s waiting; try again a moment later.

We email you the first time it happens. If it was you, there’s nothing to do. If it wasn’t, your password still protects the account. If you think someone knows it, press This wasn’t me in that email to sign out everywhere and choose a new one.

Active Browsers

Use active browser controls to:

• identify the current browser;
• remove old sessions;
• remove every other session;
• set a shorter or longer idle sign-out time.

Use Audit when you need to compare session history or export safe support context. Use Profile when you need to remove sessions or change security settings.

Sign-In Alerts

Thalovant emails you when someone signs in to your account from a browser it hasn’t seen before, or from a country and region the account hasn’t signed in from in the last 90 days. Signing in from your usual browser, where you usually are, sends nothing. You also get an email when an API token is created, when MFA is turned on or off, when your password changes, and when a device is paired with one of your hubs.

Each email says when it happened, roughly where, and which browser and system it came from. If it was you, there’s nothing to do. If it wasn’t, press This wasn’t me. The page that opens asks you to confirm first. Then it signs your account out everywhere, revokes your API tokens and stops your current password from working, and we email you a link to choose a new one. If you sign in with Google or GitHub, that account is the one to secure. The page also lists connections paired around the time of the alert, because those keep working until you remove them on Connections.

The button works once, for 24 hours, and only from the email it arrived in. Thalovant knows your browser by a cookie it sets when you sign in to the dashboard. Clear your cookies and your next sign-in looks new, so expect one email for it.

Recent Sign-Ins

Profile lists your latest sign-ins with the time, the approximate place, the browser and system, and how you signed in. Your own session is marked, and Sign out of all other sessions ends every other one.

This history is kept for 90 days. Thalovant stores the city, region and country your connection appeared to come from, never your IP address: the address is looked up on Thalovant’s own servers and dropped. Places are approximate and come from DB-IP’s IP to City Lite database (IP geolocation by DB-IP, CC BY 4.0). The history is part of your account export and is deleted with the account.

Export and Retention

Choose Download account data to create a JSON file containing your profile, safe resource inventory, retained memory, API-token metadata, approved browser origins, session metadata, and your recent sign-ins. The export includes memory content because it’s your account copy.

The export never includes passwords or hashes, authenticator secrets, recovery codes, API-token hashes, setup credentials, private runtime specifications, or payment-provider identifiers. Keep the file private and inspect it before sharing any part of it.

Account resources remain until you delete them or delete the account. Memory remains under your control until deletion, expiry, or account deletion. Session records remain through expiry, revocation, and operational cleanup. Account deletion erases identity-linked analytics and audit traces; one unlinkable deletion marker and non-identifying aggregates may remain.

Before Getting a Connection File

Because setup links and client connection files behave like passwords, check Profile first when access is blocked or sensitive:

1. Confirm two-step sign-in is enabled and working.
2. Confirm recovery codes are stored safely.
3. Remove browser sessions you no longer recognize.
4. Return to Connections and get setup material only when you’re ready to place it with the connecting app or device.

Destructive Actions

Download and inspect your account export before deletion if you want a copy. Account deletion can’t be undone: it removes the sign-in, revokes sessions, and erases linked resources and identity-linked telemetry. Don’t use account actions to fix a hub or client issue. Those issues belong on Hubs, Clients, Access rules, Skills, Dashboard, or Topology.

Profile Is Ready When

Profile is ready when:

• your name and avatar are recognizable to teammates;
• two-step sign-in is enabled when required;
• recovery codes are stored somewhere safe;
• old browser sessions are removed;
• an account export has been downloaded and stored privately when needed;
• Audit has been checked when session history or support evidence matters;
• you know whether the next question belongs in Profile or another page.