Security

Your account is how Vistazo knows you across every workspace you belong to. Settings → Security holds how you sign in, who can act for you, and the account itself, with a card for each part.

Add a passkey on each device you sign in from. A new passkey is named after its device, such as "Windows · Chrome", and you can rename it by selecting the name.

Your email address is a way to reach your account. Changing it with Change on the Identity card leaves the account itself as it was. Vistazo emails the old address a link that undoes the change.

An account that signs in through single sign-on can start with an unverified email address. On your first sign-in, a Verify your email screen sends a 6-digit code to it. Verifying lets people share with you at that address. You can choose Skip for now and verify later with Verify on the Identity card.

Vistazo's second factor is a code from an authenticator app, and any authenticator app works. Turning it on gives you recovery codes, and Replace recovery codes issues a new set. Keep the codes somewhere other than the phone that holds the authenticator.

Some changes ask you to prove it is you at the moment you make them.

• Setting or changing your password
• Adding or removing a passkey
• Linking or unlinking Google or Microsoft
• Setting up an authenticator, replacing recovery codes or turning two-factor off
• Changing your email address
• Downloading your data
• Deleting your account

Confirming with a passkey or an authenticator code covers any of these in the same browser tab for 15 minutes, so working through several asks once. A code sent by email covers only the kind of change it was sent for.

Nobody can recover a work address at an employer you have left, and support never moves an account to a different address. Support can copy the dashboards, notebooks and skills you own into a new account you control. Chats, uploaded files and datasets do not come across. Every data connection has to be authorized again from the new account, because that authorization belongs to the provider.

Before you leave an employer, add a passkey or turn on two-factor, or change the account to an address you keep.

Every agent you have added to Vistazo is listed here with when it was last used, and a Revoke button. An access token lasts an hour, and the client refreshes it in the background. The refresh token lasts 30 days and extends each time it is used, so a client you use regularly stays signed in. Revoking takes effect within about a minute. An issued token cannot be recalled, so the server re-checks the grant behind a short cache.

Sites that show embeds using your Vistazo sign-in are listed too, one row per site, such as notion.so, reading "Embedded views" with when they were last used. Revoke signs every page on that site out of Vistazo, and its embeds ask you to sign in again. Sign out everywhere else, changing your password, changing your email address and turning on two-factor sign those sites out as well.

Support access gives Vistazo support read-only access to your account while they help with a problem, for a length of time you choose. You are notified each time they sign in, and View history lists every visit. Revoke ends access early. A workspace can stop its members from granting it, and the card then names that workspace.

Download your data opens a list with Chats, Dashboards, Skills, Notebooks and Files. Each one downloads as its own zip, which opens in a browser as a copy you can look through.

You can download each kind twice a day. The download covers what closing your account would delete. Content held by workspaces you only belong to is not included.

Delete account asks you to prove it is you, and the account can then be restored for 30 days. During that time the account is suspended, and signing in reaches a restore screen and nothing else. After 30 days the account and its data are deleted.

Download your data first if you want a copy. Nothing can be downloaded once the account is suspended.