I Think Someone Else Accessed My Account
Sign out every other session in Profile Settings, secure your mailbox, remove any sign-in method you do not recognise, turn on two-factor protection, then check what was changed.
Flidu has no passwords. You sign in with a code sent to your email, with Google, or with a passkey. That means anyone who can read the mailbox of your sign-in email, or who holds a passkey on your account, can sign in as you. If you see a session you do not recognise, a security email about a change you did not make, or changes in your dashboard that nobody on your team made, act in this order.
Sign Out Every Other Session
- Open the account menu at the top of the dashboard and choose Profile Settings.
- Scroll to Sessions & Devices. Each row is a place where your account is signed in, named by device and browser, such as Mac · Chrome, with the day it signed in and when it was last active. The one you are using is marked This Device.
- Select Sign Out All Other Sessions, then confirm with Sign Out Others.
Every other session ends immediately, and Flidu emails you a notice. To end one session only, use Sign Out Session on its row. If the card says there are no other sessions, nobody else is signed in right now. Flidu does not show a location or a network address for a session, so judge by the device, the browser and the dates.
Secure Your Mailbox
A sign-in code goes to your email, so someone who can read your mailbox can sign in to Flidu again straight after you sign them out. Before you go further, change the password of the email account itself and review its own security settings. If you sign in to Flidu with Google, do the same for your Google account.
Check Your Sign-In Methods
Still in Profile Settings, go through each card.
| Card | What To Check | What To Do |
|---|---|---|
| Email Address | The Verified Email is your address. | If it is not, read the last section of this article. |
| Passkeys | You added every passkey listed. Each one shows its name, the day it was added and when it was last used. | Remove any you do not recognise. |
| Authenticator App | If it shows Enabled, the app is on a device you hold. | If someone else may have it, Remove it and set it up again on your own device. |
| Recovery Codes | Nobody else has seen your codes. | Regenerate them. Every older code stops working. |
| Connected Accounts | Google shows Connected only if you connected it. | Disconnect it if you did not. |
Removing a method, regenerating codes and disconnecting Google each open a Verify It’s You dialog first, which asks for your authenticator app or a passkey. If you have neither yet, the dialog asks you to add one first, which the next section covers. Flidu emails you a security notice for each of these changes. Removing the authenticator app also signs out your other sessions and stops its recovery codes from working.
Turn On Two-Factor Protection
If the Two-Factor Protection card shows Off, a code from your mailbox is all it takes to sign in. Select Turn On Protection, then add a passkey or set up an authenticator app. From then on, signing in with an email code or Google also asks for that second method, so access to your mailbox alone is no longer enough. When you set up an authenticator app, save the recovery codes you are given. The steps are in How Flidu Protects Sessions.
Check What Was Changed
- Team. Open Team and look through Active Members and Pending Invitations for anyone you did not add. An Owner or Admin can revoke an invitation. Only the Owner can remove a member.
- Ownership. If you were the Owner of a workspace and your badge now says Admin, ownership was transferred. Contact Flidu straight away.
- Billing. If you have billing access, open Billing and check the plan on each product line.
- Widgets and assistants. Check the details visitors act on: the numbers and links in your channels, the notification email on your forms, and the sources your AI Chatbot answers from.
- Security emails. Search your mailbox for messages from Flidu about passkeys, authenticator apps, recovery codes, Google or your sign-in email. Each one marks a change to your account.
If You Cannot Sign In Or Undo A Change
Some situations cannot be fixed from the dashboard:
- Your sign-in email was changed to an address you do not control.
- Sign-in now stops at One More Step and asks for a passkey or an authenticator app you never set up.
- Ownership of a workspace was transferred away from you.
Contact Flidu and choose the topic Security or privacy. Use an address where you can receive mail, give the email on the account, and say what you saw and when. Support reviews the account with you and needs to confirm that it is yours before anything is changed. An email on its own does not restore access.
What A Correct Result Looks Like
Sessions & Devices lists only this device, or devices you know. Every passkey is yours, Two-Factor Protection shows On, and the Team page lists only people you invited.