Security
Sessions, passwords and access
What happens to existing access on logout, on a password change and when users or connectors are removed
This page describes when enneo ends a sign-in, which access ends with it and which stays. It applies to local sign-in with a password as well as to SSO, unless stated otherwise.
Logging out
Logging out ends the session in the browser. All enneo services notice within a minute. An expired session also requires a new sign-in straight away.
On logout enneo also removes user-specific data from the browser, so the next person on the same device does not see it:
- drafts in the editor
- ticket filters including the search text, as well as export and phone filters
- unfinished connections of NEO connectors
Personal display settings stay: theme, layout, sort order and the selected audio devices.
Password requirements
A new password must be at least 12 and at most 128 characters long. enneo refuses commonly used passwords. There are no rules about digits, capital letters or special characters: a longer passphrase of several words is stronger and easier to remember.
The requirements apply whenever a password is set: when a user is created, on a change and through "Forgot password". Existing passwords keep working, even if they are shorter.
Changing the password
A user who sets a new password in their own profile stays signed in in the current browser. All other sessions of that user end, for example in another browser or on another device.
The change also disconnects every AI assistant connected through OAuth, such as Claude or ChatGPT through the MCP server. The assistant has to connect again afterwards.
| Trigger | What ends |
|---|---|
| Own password changed in the profile | all other sessions and connected assistants; the current session stays |
| Password set again through "Forgot password" | all sessions and assistants from before the recovery |
| An administrator sets another user's password | all sessions and assistants of that user |
Note
API keys from the profile or from a service worker stay valid after a password change. If you suspect that a key has fallen into the wrong hands, revoke it in the key list.
New users
The welcome email never contains a password. When an administrator creates a user with a password, the email tells the user to sign in with the password the administrator gave them, or to set their own through "Forgot password". So share the password through a channel other than email.
API keys for other users
Administrators can create and revoke API keys for other users, but only for users whose role has no more rights than their own. This is not possible for accounts of enneo staff.
Removing users
When a user is deleted, enneo also disconnects the NEO connectors that user connected through OAuth: the connection is revoked at the provider and the stored credentials are deleted.
Removing NEO connectors
When a connector is removed, enneo revokes an OAuth connection at the provider and deletes the stored credentials. If the revocation fails, the connector stays and the removal can be retried.
Warning
enneo deletes a static API key only from its own storage. It stays valid at the provider. Revoke or rotate it there once it is no longer needed.
Knowledge base with team restriction
When an article or folder is restricted to certain teams, this applies to every kind of access: users from other teams see it neither in the file list nor when opening it, and cannot edit, move, delete it or download the original.
For integrations
- Requests that authenticate with the session cookie and come from another
website are refused by enneo with
403 cross_origin_request_refused. Integrations authenticate with a token in theAuthorizationheader, see Authorization. - After an SSO sign-in, enneo only redirects to addresses of its own instance.
A
redirectTopointing to another domain leads to the start page.