Sessions and security

Every device signed into your account, and a way to end any of them.

Active sessions

Device	Location	Last active
GROM Android 0.5.84Xiaomi 2211133G	Tashkent, UZ84.54.0.0	Current session
GROM Desktop 0.5.71Linux	Tashkent, UZ84.54.0.0	2 hours ago	Terminate
GROM WebChrome on Windows	Samarkand, UZ213.230.0.0	3 days ago	Terminate

What to look for

A session list is only useful if you know what a compromise looks like in it. Two signals matter more than the rest:

• A device you do not recognise. Names come from the client that signed in and can be anything, so treat the pairing of device and location as the signal rather than the name alone.
• A location you have not been. Approximate and derived from IP, so a nearby city or a VPN exit is normal. A different country you have not travelled to is not.

If something is wrong, terminate it and then change your cloud password. Terminating alone ends the session but does not stop whoever it was from signing in again with whatever they used the first time.

Inactive sessions end on their own

A session with no activity for six months is terminated automatically. This is not a substitute for reviewing the list — six months is a long time — but it does mean a forgotten sign-in on a device you no longer own does not stay open forever.

Planned

• Which api_id each session signed in through, so a session can be traced to an application.
• Web sessions listed separately from app sessions.
• Sign-in history for the last 90 days, including failed attempts.