How do automatic sign-outs work?

A shared device is signed out after the venue's idle time, with a warning first — one number for the whole venue; service screens and the customer portal have their own rules.

If a shared device is left untouched for too long, ResoFlow shows a warning with a countdown, then signs it out — and you choose how long "too long" is.

The time lives in Settings → Security policy → Sessions and timeouts. Only Owners and Admins can change it; other staff see it read-only.

• Open Settings → Security policy and open Sessions and timeouts.
• Sign out a shared device — how many minutes a shared computer or a staff PIN sign-in can go unused before it's signed out. Default 30, anywhere from 5 to 240. It's one number for the whole venue, whoever is signed in.
• Customer portal auto sign-out — the same idea for your customers in your customer portal. Default 30 minutes, 5–240; customers see a 5-minute warning first.
• Click Save changes. The new time applies straight away.

What the person sees. Five minutes before the time is up, a "Still there?" pop-up counts down. Anything they do — a tap, a click, typing or scrolling, in any open tab — closes it and starts the clock again; Stay signed in does the same and Sign out now signs out at once. It makes no sound. If the time runs out they're signed out, the sign-in page says why in one sentence — for example "You were signed out after 30 minutes without use." — and after signing in again they come back to the page they were on. Every other open tab says the same thing.

Your own phone or computer. Straight after signing in to the dashboard you're asked "Keep me signed in on this device?". Say it's yours and that device isn't signed out for being unused — it stays signed in for 30 days after it was last used. If your account doesn't have a passkey for this site yet, a phone or computer with its own lock (Face ID, a fingerprint, Windows Hello) then offers one, so its lock signs you in next time — see How do I sign in with Face ID or a fingerprint (passkeys)?; if your account has neither two-step sign-in nor a passkey, you're offered two-step sign-in. Not now on either offer waits 30 days. Say it's shared (or close the question) and the time above applies.

Your "Yes, it's mine" is remembered for your account on that browser: the next time you sign in there you aren't asked again, and the device is kept signed in the same way. You're asked again after 30 days without signing in there, after you change your password or use Sign out everywhere, or if you choose Sign out and forget this device when you sign out. Someone else signing in on the same browser is asked for their own account, and "No, other people use it" is never remembered — you're asked each time. The answer can only be saved straight after signing in, so a device that comes back to an older sign-in (say, a laptop opened the next morning) shows "Sign in again to keep this device signed in" instead of the question. A venue device paired for the staff portal is never asked — it always follows the time above.

A phone or tablet that's asleep isn't signed out for sleeping. The time counts from the last tap on that device and is checked the moment the screen wakes, so a phone that was locked for 10 minutes carries on where it was. A Wi-Fi drop doesn't sign anyone out either.

Coming back to a closed or reloaded tab. The time counts from the last time the device was used, even while the page wasn't open. So if the browser closed the tab to save memory and reloads it when you come back, or you open the dashboard again later from a bookmark, and the time ran out in between, it shows "Signing you out…" for a moment and opens at the sign-in page rather than carrying on. Signing in — with a password, Google, a passkey or a staff PIN — always starts the time again. Only things a person does count as use — a page moving by itself never does. Staff tapping the Orders screen count, even while it isn't timed; a wall screen (a board under Wall screens, or an Orders screen set to Wall) doesn't, so a wall screen open in another tab never keeps the dashboard signed in. Going from a service screen to another page starts the time again, and so does coming back within 2 hours from Stripe in the same tab — after setting up Stripe, or after your bank's card check when it opens on its own page.

Being signed out this way doesn't switch off that phone's alerts — only signing out on purpose (or the device being removed) does.

Customers using the customer portal with "Keep me signed in on this device for 30 days" ticked aren't idle-timed — the timer there only applies to un-remembered (e.g. shared-device) sessions.

Service screens. By default your service screens — the wall boards under Wall screens and the Orders board — are never signed out for being unused, so a wall screen stays on and a busy service is never interrupted mid-order. That's the Keep service screens signed in switch in Settings → Security policy → Sessions and timeouts (on by default); turn it off and those screens follow the shared-device time above. The Orders screen's Counter and Pass layouts still need a fresh sign-in each day — 24 hours after a dashboard sign-in, 12 hours after a staff PIN (for the screen and for every tap). Wall screens stay signed in. Run the Orders board or a wall screen on its own device, or in its own browser profile: a dashboard tab left unused in the same browser signs that whole browser out when its time runs out, the screen included.

Related: How do I see and end active sessions? · What do staff see in the portal (vs my dashboard)?