Login journal

The security journal is your account's history of sign-ins and important events. It makes suspicious activity easy to spot.

Where to look: Settings → Security → journal.

What's recorded:

• Account sign-ins: date and time, IP address, country (by IP, with a flag), browser/device.
• Enabling and disabling 2FA.

Why it matters:

• If you see a sign-in from an unfamiliar country or device — that's a signal. Change your access method, enable 2FA, review shares.
• Handy for teams: you can see who signed in and when.

What to do if suspicious:

1. Enable 2FA if not already on.
2. Check who has access to your services (“Share access”) and revoke if needed.
3. Change panel passwords and refresh SSH keys.

The journal is append-only — entries can't be forged retroactively. Geolocation is determined by IP and may be absent if a request comes without country data.