Security Activity Log
Applies to: All plans · Last reviewed: October 2026
5 min read
Version 2.0 | Last updated: October 2026
ClientFlow records the security-relevant events on your account — lockouts, password changes, two-factor changes, session and device activity — and shows them to you at Settings → Security & Privacy.
Scope: this log covers account security events. It is not a data-access audit trail: ClientFlow does not record which client records you opened or which payments you edited, and there is no per-record access history. If you need that for a regulator, ClientFlow cannot supply it today.
What Gets Logged
| Category | Events |
|---|---|
| Sign-in | Lockout after repeated failed sign-ins, sign-in with an emailed login link |
| Password | Password set, password changed, admin-initiated reset |
| Two-factor | Enabled, disabled, verified, failed, backup code used, backup codes regenerated, recovery started or cancelled |
| Devices | Trusted device added or removed |
| Sessions | Session revoked, all sessions revoked |
| Connected accounts | OAuth provider linked, unlinked, or externally revoked |
| Account | Recovery email added or verified |
What Is Not Logged
- Ordinary password sign-ins (successful or failed) and sign-outs
- Password-reset requests, email-address changes and account deletion
- Opening, editing or deleting a client, payment, appointment or note
- File downloads and exports
- The contents of any record
Reading the Log
Go to Settings → Security & Privacy. Each entry shows the event, when it happened, and the IP address it came from. You can:
- Filter by event type
- Filter by date range
- Page through older entries
No export. The log is read-only in the dashboard — there is no CSV, JSON or PDF download. If you need a copy for an investigation, contact support.
Automatic Protections
| Trigger | What happens |
|---|---|
| Repeated failed sign-in attempts | The account is temporarily locked and a lockout event is written |
| Sign-in from a new device or location | ClientFlow emails you a security notification so you can spot access you did not authorise (if security notifications are switched on). No entry is added to the log |
| Rate limit exceeded | The request is throttled (HTTP 429) |
Revoking a session, or all sessions, from Settings → Security & Privacy signs that device out immediately and records the action.
Questions
Support: contact@clientflow.center
Read time: ~5 minutes | Audience: Account owners, IT
Was this helpful?