Login history, active sessions and trusted devices
Your dashboard keeps a record of who signed in, from where, and which devices are still signed in. Here's how to read it and what to do about anything unfamiliar.
Sign in at dash.mypandos.io, open Profile from the account menu. Two tabs there tell you everything about access to your account: Security (Security Overview, Active Sessions and Trusted Devices) and Login History.
Security Overview
The summary at the top shows whether two-factor authentication is enabled, when you last signed in, and how many of your recent sign-ins succeeded.
Login History (its own tab)
A list of your most recent sign-in attempts — up to your last 50. Each row shows:
- Date and time of the attempt
- Device, browser and operating system, worked out from the connecting client
- Location and IP address
- Whether it succeeded or failed, and whether two-factor authentication was verified
Failed attempts are shown too, on purpose. A single failure is usually just a mistyped password. A run of failures from places you have never been is worth telling us about. Repeated failures from the same address are automatically blocked for a while, so a password-guessing attack does not get unlimited tries.
Location is derived from the IP address and is approximate. A mobile network or a VPN can place you in a different city, or a different country, from where you actually are — check the device and the time before concluding something is wrong.
Active Sessions
Every device currently signed in to your account, with when it was last active. The one you are using is marked This Device.
- Revoke signs out one device.
- Sign Out All Devices signs out everything else at once — the right button when you have used a shared or public computer, or lost a phone.
Trusted Devices
Devices where your two-factor verification is remembered, so you are not challenged on every single sign-in. Each one shows when it was added, when it was last used, and when it expires — they do not last forever.
Revoke a trusted device and the next sign-in from it requires two-factor authentication again. Revoke any device you no longer have, or no longer trust.
If you see something you do not recognise
- Change your password first, from the Security tab. This signs out your other sessions and clears every trusted device in one action — it is the fastest way to cut off access.
- Check your multi-factor methods. Remove any authenticator or passkey you did not add, and regenerate your backup codes.
- Review your account details — contact email, phone number and billing details — for changes you did not make.
- Tell us. Open a ticket from the Support section of your dashboard and include the date, time, IP address and location exactly as they appear in the row. That lets us match it against what we can see on our side.
If you receive a password-change confirmation email that you did not trigger, do not wait — contact us immediately. That is one of the clearest signs that someone else has reached your account.