Quick answer
Signing in requires a second factor as well as your password, every time. If you stop using AllDone, a warning appears after a period of inactivity and you are signed out shortly afterwards. A session also ends for good after a month, whatever you do, so you will be asked to sign in again from time to time.
Two-factor authentication
Two-factor is not optional and is not a firm setting. It is required for every user on every sign-in, and the terms of service put the same obligation on the firm. Setting it up is part of your first sign-in. See Signing in for the first time and setting up two-factor authentication.
AllDone never sees or stores your password; sign-in is handled by the identity provider on your behalf.
The inactivity timeout
Half an hour of doing nothing brings up a Still there? prompt. You have a minute to say yes before you are signed out. Anything counts as activity: moving the mouse, typing, scrolling, touching the screen, or the page fetching something because you opened a card or a schedule. Reading a long report on screen keeps the session alive.
If the timeout does sign you out, the signed-out page says the session ended after a period of inactivity. Nothing is lost: a decision is saved when you record it, and an upload is stored when it finishes. Sign in again and the job is exactly where you left it.
The absolute limit
Separately from inactivity, a session cannot run for more than thirty days. When it expires you simply sign in again. A run in progress is unaffected: runs are queued on the server and continue whether or not your browser is open, so you can sign out and come back to a finished step. See Running a step, the run banner, and what a re-run changes.
Signing out on purpose
Use the sign-out control rather than closing the tab, especially on a shared machine. A partner can also change or remove a user's access at any time from the users screen, which takes effect at their next request.
If something looks wrong
You are signed out more often than you expect. Check you are not leaving the tab open on a screen that never fetches anything. The prompt appears before the sign-out, so you can always keep the session.
Sign-in loops back to the sign-in page. The session has expired in a background tab. Close the extra tabs and sign in once.
You cannot complete two-factor. Your phone or authenticator has changed. Ask a partner in your firm, who can help you re-enrol.
Related