Security Guide

Sessions & Security

Understand StationCommand session lifetimes, inactivity protection, recent-auth requirements, revocation, audit records, and approximate IP geography.

Default session behavior

StationCommand member sessions default to a maximum of 30 days. A normal Sign Out clears only the current browser/device session.

Opening /login with a valid session sends the member directly to the menu instead of restarting the OAuth chooser.

Session Security administration

Go to Administration → Analytics & Security → Session Security.

Maximum lifetimeConfigure separate maximum session lifetimes for Members and privileged Admin/EOC Manager accounts.

Inactivity timeoutEnabled by default at 7 days; active sessions refresh activity without extending past the absolute lifetime.

Recent authenticationEnabled by default with a 60-minute window for sensitive admin actions.

Step-up sign-inStationCommand can require a fresh Google/Microsoft sign-in before account changes, session revocation, license changes, incident purge, or stored credential changes.

Sign out everywhere

Members can use My Settings → Session Security → Sign Out of All Sessions. Administrators can use Personnel account controls to revoke all sessions for another authorized user.

Application Audit Trail

Administration → Analytics & Security contains application/security auditing for administrator actions and integrations. StationCommand Home / Respond API access is also audited; bearer tokens themselves are never written to the audit trail.

IP geography

Analytics & Security can use a managed local GeoLite2 City database for approximate city/region/country context. IP geolocation is approximate and is not a household/street-address locator.