Frequently asked questions
Plans and limits
What are the plan limits and scan frequencies?
See the overview plan table for domain and member limits and daily or weekly frequency. Members include you and valid invitations. Read more
Does a lower plan delete my data?
Existing domains and members remain. Additions stop at the limit, and accepting an invitation also checks capacity. Read more
Organizations
How do I switch organizations?
Choose it from the organization menu in the header. Check the name before performing an operation. Read more
How many organizations can I own?
An account can own 3 organizations. Creation, OWNER invitations and promotions use the same limit. Read more
How do roles differ?
All roles can read; MEMBER and above can run evaluations. OWNER / ADMIN manage domains and invitations; OWNER manages organization authentication and access settings. Read more
Invitations
My invitation has not arrived.
Check spam and the destination address, then ask the inviter to resend. Older links stop working after a resend. Read more
When does an invitation expire?
Invitations last 7 days. Ask for a resend after expiry. Read more
I signed in with a different address.
The destination must be your verified primary or additional address. Sign in to the intended account or add and verify the address on your original account. Read more
The member limit blocks an invitation.
Valid invitations reserve seats. Cancel unneeded invitations to free capacity. Acceptance also checks the limit. Read more
Email addresses
Can I use multiple addresses?
Add an address in Settings and open the verification link within 24 hours. Once verified, it signs in to the same account. Read more
Why does it say “in use”?
The address belongs to another account. Accounts are not automatically merged. Read more
Can I change or delete my primary address?
Swap it with a verified additional address. The old primary remains as an additional address. The primary cannot be deleted directly. Read more
Multi-factor authentication
How do I change authenticator devices?
Sign in using a current or unused recovery code, disable authenticator setup, and enroll the new device. Store the new recovery codes. Read more
I lost both my device and recovery codes.
Contact support using the contact details on the linked page. After identity verification, an operator can reset MFA and end existing sessions. Read more
My organization requires MFA.
Complete setup before accessing the organization. A registered passkey or that organization’s SSO also meets the requirement. Read more
Verification is locked.
After 5 failures, verification locks for 10 minutes. Wait and use a current code; recovery codes cannot bypass the lock. Read more
Passkeys
Which devices support passkeys?
Use an environment supporting WebAuthn passkeys and user verification. Synchronization depends on your passkey storage. Unsupported browsers cannot add or sign in with passkeys. Read more
I lost my passkey device.
Use another passkey or email sign-in, then delete the lost passkey. Email sign-in still requires a code when authenticator MFA is enabled. Read more
Why can’t I use a passkey on an SSO domain?
Addresses on verified domains with active SSO use SSO, rather than email links or passkeys. Read more
SSO and IP restrictions
Why is no sign-in email arriving?
Email links are not sent to addresses on verified domains with active SSO. Use SSO. Read more
Why can’t I join through SSO?
Ask the OWNER to check domain verification and capacity including valid invitations. Restart expired requests. Read more
How do I renew the IdP certificate?
Save metadata with the new signing certificate, test successfully and enable SSO again. Saving disables SSO, so plan the cutover. Read more
I am locked out of the organization.
Contact support using the linked page. An operator can disable IP restrictions or clear the SSO requirement after identity verification. Read more
Why can’t I connect from home?
If IP restrictions are enabled, your home or VPN egress IP must be allowed. Ask your OWNER to check it. Read more
API and audit logs
When does my token expire?
365 days after issuance or reissuance. Create a new token after expiry. Read more
How do suspension and reissuance differ?
Suspension can be resumed with the same secret. Reissuance revokes the old token and requires updating the collector to the new secret. Read more
What if the issuer leaves?
Their tokens are automatically revoked. A current OWNER or ADMIN must issue a new token. Read more
How long are audit logs retained?
The retention period is 366 days. Older events are automatically deleted every hour and can no longer be retrieved through the API. For long-term storage, retrieve them before the period ends and keep them in the receiving system. Organization deletion removes its logs. Read more
How do I reduce missed events?
Keep a fixed end time, retrieve all pages, then overlap the next window by 10 minutes and deduplicate on event_id. Advance the checkpoint only after successful storage. Read more
Which plans support the API?
Business and MSP. Audit events themselves are recorded on every plan. Read more
Evaluation results
What do tcp / udp / unknown mean?
tcp means a successful connection, udp a matching probe response, and unknown an unconfirmed protocol. Unknown does not mean closed. Read more
When is a port “new”?
When a previously observed host now has a port number absent from its previous result. Resolving an unknown protocol alone is not a new port. Read more
Why is port information empty without ownership verification?
Active checks require ownership and destination safety checks. Public index information may still exist; an empty field does not prove that ports are closed. Read more