Security and privacy

Open Settings → Security & Privacy. Treat an unfamiliar device, sign-in or connected AI app as a security incident: remove its access — sessions and devices on this page, AI apps under MCP & AI apps — and report it to the organization's administrator.

Password

For accounts with a Persate password, Change password opens the Set a password dialog with Current password, New password and Repeat new password. A new password needs at least 8 characters with a lowercase letter, an uppercase letter, a number and a special character such as ! ? # or @. Passwords that appear in known data breaches are refused; the dialog lists the rules under Your password must include:.

Accounts that sign in with a Google or Microsoft account show Managed by provider instead. Their password is changed with that provider.

Two-step verification

Two-step verification adds a code from an authenticator app to sign-in. It is optional for most accounts, but company files require it: viewing file information, uploading files, and file tools in Advisor and in connected AI apps. System administrator accounts must use it. See Two-factor authentication.

An account without an authenticator shows Set up, which starts the setup. Once an authenticator is set up, the row names it and shows the status Active, and sign-in requires a code unless the browser is trusted.

To move to a new device, select Replace authenticator. The current authenticator stays active until the new one is set up, so keep the new device at hand before confirming. Select Yes, replace; Persate asks to confirm the user's identity and then opens the setup of the new authenticator. Cancel keeps the current one.

Active sessions

Active sessions lists the devices signed in to the account, with the browser and device, the IP address where available, and Last active. The current session is marked This device.

Select Sign out next to a session that is not recognized, or Sign out all other devices to end every session except the current one.

Trusted devices

Trusted devices lists browsers allowed to skip the authenticator code at sign-in for up to 30 days. Trust applies to one browser, not to the whole computer, and actions that need extra protection still require verification. A browser appears here after a sign-in with the authenticator code in which the user chose to trust it.

Managing trusted devices can require a current code: Verify before managing trusted devices asks for the 6-digit authenticator code, confirmed with Verify. The list then shows each browser with the dates it was first trusted, last used and when the trust expires; the current browser is marked This browser.

• Revoke trust removes trust from one browser.
• Revoke all other trusted devices removes trust from every browser except the current one.
• Log out and forget this device ends the current session; this browser needs an authenticator code at its next sign-in.

Each action asks for confirmation. Revocation takes effect immediately, and sessions established through that trust are ended too.

MCP and AI apps

The MCP & AI apps row refers to AI apps, such as ChatGPT or Claude, allowed to use Persate on the user's behalf through an external connection. Select Manage AI connections to open Settings → MCP & AI apps, where the connected apps are listed and can be disconnected. See MCP and AI apps.

Login history

Login history lists recent account events — for example sign-ins, sign-ins through single sign-on, sign-outs, password and email changes — with the time, device and, where available, the IP address. Repeated session activity appears as one entry with its latest time.

If the list does not load, refresh the page; an empty list does not by itself prove that there was no activity.

Analytics cookies

Analytics cookies shows the choice stored in this browser: allowed, declined, or not made yet. Persate runs product analytics only after Accept in the cookie notice. Before a choice is made, and after Decline, product analytics do not run and no analytics cookies are stored.

Visits to the public website and to this documentation are counted without cookies, whatever the choice: nothing is stored in the browser, and the visit is not linked to the account. Nothing is counted while the browser's Do Not Track setting is on. The privacy policy at persate.com/documents/privacy-policy describes both.

Select Cookie settings to change or withdraw the choice. Product analytics stop immediately, their cookies are deleted, and the cookie notice opens again. The same Cookie settings link is under the sign-in form and in the website footer. The choice applies to one browser; repeat it in other browsers and on other devices.

Data and export

Data & export downloads a copy of the user's personal data as a structured, machine-readable JSON file (GDPR Articles 15 and 20). The file contains account details, profile and preferences, organization membership, a list of the files the user owns, active sessions and login history.

1. Select Request export.
2. Accounts with a Persate password enter the Current password; accounts that sign in with Google or Microsoft confirm through two-step verification when asked.
3. Select Download my data. The browser downloads the file directly; nothing is sent by email.

File contents are not part of the export; download them from the Repository. For requests the export does not cover, including permanent account deletion, use the organization's approved support channel.

Troubleshooting

• Authenticator code rejected — use the current six-digit code and check that the device clock is accurate.
• Trusted devices asks for a code again — managing trusted devices requires a fresh authenticator code; a remembered browser is not enough.
• Unknown session, sign-in or connected AI app — sign the session out or disconnect the app under MCP & AI apps, change the password if the account has one, and report it.