Auto-logout policies: signing out idle sessions
An auto-logout policy ends a session after a set time without activity, with a warning before it happens. In Swiftly Workspace an admin sets it under Administration, then Security, as a default members may change or enforced for everyone. Out of the box it is on, at five minutes.
A lot of everyday risk in a small business has nothing to do with hackers. It looks like a laptop left open in a café, an iPad passed around a workshop, or a phone handed to a colleague "just for a second". An idle timeout is the cheap control that closes those gaps, as long as it is set at a length people can live with.
Choosing a timeout that people won't fight
Too short, and people get signed out mid-thought and look for ways around it. Too long, and the protection is mostly theoretical. A reasonable starting point depends on where the devices are used:
| Situation | A sensible timeout | Why |
|---|---|---|
| Shared iPad at a counter or in a workshop | 1 to 5 minutes | Anyone walking past could pick it up |
| Laptops in a shared office | 5 to 15 minutes | Short breaks happen, colleagues are around |
| Phones carried by one person | 5 to 15 minutes | The phone has its own lock, but it is often unlocked in hand |
| A desk in a private office | 30 minutes to 1 hour | Lower risk; long reading or calls without typing |
Whatever you choose, pair it with a warning. A short countdown gives the person in front of the screen a chance to stay, so the timeout takes effect when nobody is there.
The company policy and personal settings
Swiftly separates what the company decides from what each person prefers. Under Administration, then Security, the Auto-Logout Policy section has a Policy Mode with two choices:
- Users may override (default). The values you set are where every member starts, and each person can change their own.
- Enforced for everyone. The values apply to every member, and their own controls are locked.
Next to the mode you set Auto-Logout on or off, the Timeout and the Warning, then save. The timeout ranges from 1 minute to 2 hours, and the warning from 15 seconds to 2 minutes, always shorter than the timeout. New companies start with auto-logout on, a five-minute timeout, a 30-second warning and members free to override.
Each person finds their own setting under My Account, then Security. They can keep Use company default or pick Custom with their own Timeout and Warning. The choice belongs to their account, so it applies on every iPhone, iPad and Mac they sign in on. When the company enforces the policy, the controls are locked and marked Managed by your organization.
Changing the company policy is an administration task. The Standard role new members get doesn't include it, so a colleague can't quietly switch it off for everyone; default roles for new members explains what that role leaves out.
What happens when time runs out
- A warning appears. It asks "Are you still there?" and counts down. Choose Continue to stay, or Log Out to sign out straight away.
- On iPhone and iPad, if nobody responds, you are signed out and the app returns to the sign-in screen.
- On a Mac, if nobody responds, the session locks instead. Every open window stays where it was, hidden behind a cover, and you are asked to sign in again. Sign back in as the same person in the same company and the windows reappear as you left them.
The Mac behavior matters for people who keep several customer and invoice windows open at once. A timeout no longer means rebuilding the desk. How the Mac session lock works covers it in more detail.
The timer runs in the app on each device, using the policy it loads when you sign in. It is a guard against unattended screens, not a replacement for strong passwords or for removing people who leave the company.
Rolling it out without complaints
- Start with the default mode and a moderate timeout, then see who changes theirs and why.
- Enforce it where devices are shared. If tablets move between people, a locked policy is the honest choice.
- Explain the warning. People accept a timeout far more readily when they know a countdown comes before it.
- Review it with the rest of your access settings, such as roles and field permissions and which modules are switched on.
Auto-logout protects what is on screen. Secrets the company stores, such as AI provider keys, need protection of a different kind; how AI provider keys are stored covers that side.
Frequently asked questions
What is a good session timeout for business software?
For shared devices, a few minutes. For personal laptops in an office, 5 to 15 minutes is common. Pair any timeout with a short warning so people at the screen can stay signed in.
Can employees turn off auto-logout?
In Swiftly, if the company policy lets members override it, they can change or switch off their own. If an admin sets it to Enforced for everyone, they can't.
Do I lose unsaved work when the session times out on a Mac?
On a Mac the session locks rather than closing your windows, so they are still there when you sign back in as the same person in the same company. To be safe, save before you step away.
Is an idle timeout the same as a screen lock?
No. A device's screen lock protects the whole device; an app's idle timeout protects the business data inside the app, even while the device itself is unlocked. Use both.
Run your business on Apple.
Create your account on the web, then set up your workspace in the app on your iPhone, iPad or Mac.
Create your account
