Security and sign-in

Sumhour has no passwords. You sign in with a link sent to your email or with a passkey, and your account settings for both live on one page: open the user menu and choose “Sign-in and security”.

On the sign-in page, enter your work email and press “Email me a sign-in link”. The link works for 15 minutes. To slow down abuse, a single email address can ask for 5 links and a single network for 20 links in any 15 minutes; past that, the page asks you to wait.

If you have a passkey, press “Use a passkey” instead. Browsers that support it also offer your saved passkey right inside the email field.

On the sign-in and sign-up pages, “Continue with Google” and “Continue with Microsoft” sign you in with that account instead of an email link. Sumhour asks the provider for your name and email address only, nothing from your mailbox, calendar or files, and keeps no profile photo. The first time, a new account goes on to set up its workspace; if an account with the same email already exists, you land in it.

Google confirms the email addresses it gives out, so any Google account works. Microsoft does not confirm every address: an organisation’s administrator can put any email on a work account. Sumhour therefore uses a Microsoft account only when Microsoft says it checked the address: a personal account (Outlook.com, Hotmail, Live), or a work account whose organisation has verified its email domain with Microsoft. Otherwise the page says Microsoft did not confirm the address, and you sign in with an email link, which proves the inbox is yours.

Owners and admins of a workspace that requires passkeys still need a passkey: Google and Microsoft count like an email link for that rule. Self-hosted servers show these buttons once the administrator sets GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET or MICROSOFT_CLIENT_ID / MICROSOFT_CLIENT_SECRET (see self-hosting).

Passkeys

A passkey lets you sign in with your fingerprint, face or device PIN (Touch ID, Face ID, Windows Hello or a security key). There is nothing to type and nothing to phish.

To add one, open “Sign-in and security” and press “Add a passkey”, then follow your browser’s prompt. Adding a passkey needs a recent sign-in. If yours is too old, the page says so: sign out, sign in with the email link again and add the passkey right away.

Each passkey in the list shows when it was added and whether it is “synced across your devices” or “this device only”. Press “Remove” to delete one. You can still sign in with an email link afterwards. Sumhour refuses to remove your last passkey if a workspace you manage requires one; add another passkey first.

Devices you are signed in on

Under “Where you are signed in” you see each browser and device with your account open: the browser and system, whether it signed in with a passkey or an email link, the date, when it was last active and its IP address. Your current device comes first and is tagged “This device”, followed by the seven most recent others and a count of the rest.

Press “Sign out” next to a device to end that session, or “Sign out everywhere else” to end every session but the one you are using. A signed-out device stops working within a minute.

Require passkeys for owners and admins

An owner can turn on “Owners and admins must sign in with a passkey” under “Settings”, in the “Sign-in” section. It is off by default. With it on, someone who gets into an admin’s email still cannot act as that admin.

While the rule is on, an owner or admin whose current session came from an email link is sent to “Sign-in and security” on every page of that workspace. There they add a passkey and press “Sign in with your passkey”. Until they do, they can switch to another workspace or sign out, but not work in this one. Members, managers, accountants and contractors are not affected. API tokens and connected AI apps are separate credentials with their own switches, described in AI and agents.

Only the owner can change this setting, and only while signed in with a passkey themselves, so turning it on cannot lock them out.

The activity log

“Activity” in the sidebar lists the changes recorded in a workspace (time entries, timesheets, invoices, projects, clients, people, settings and more), each with who made it, when, and up to six changed fields shown as old value and new value. Owners, admins and managers see every change in the workspace and can filter by person under “By”. Everyone else sees only their own changes. The “Show” filter narrows it to one kind of record, and “Older” loads the next 50.

Changes made outside the web app are labelled with where they came from: “via API”, “via CLI”, “via MCP” or “via assistant”, plus the name of the token or app. Changes an AI app or the assistant made on someone’s behalf still show that person as the author. Jobs Sumhour runs by itself, such as the weekly auto-lock, are marked “automatic”. Times show in your own timezone.

Export your data

You can take your data out at any time, including when a trial or plan has ended and the workspace is read-only:

Where	What you get
Invoices, “Export”	“Invoices CSV” and “Payments CSV” for the current year or for everything, and “All PDFs (zip)” for the year
Reports, “CSV”	The report on screen with its filters: time, profitability, utilization, invoicing or uninvoiced
Expenses, “CSV”	The expenses matching the page’s filters
API and CLI	Anything your role can read, as JSON, with a read-only token

Invoice exports need the accountant, admin or owner role. Reports need a manager, accountant, admin or owner. See reports and AI and agents for tokens.

How workspaces are kept apart

Every workspace’s data is separate. All reads and writes go through one server layer that checks the workspace and your role on each request, and every query is filtered by workspace. This is enforced in the application, not with database row-level security. An automated test suite seeds two workspaces and checks, over the REST API and MCP, that one cannot see or change the other’s data; it runs on every change, and a new build is not deployed until it passes.

API tokens and AI app connections each belong to one person in one workspace. Their reach is that person’s current role, narrowed by the permissions picked for the token, and the role is checked on every call.
Sumhour stores only a hash of each API token, never the token itself.
Credentials for Harvest, QuickBooks, Xero, Google, Slack and webhook secrets are stored encrypted.
On Sumhour Cloud, webhook URLs must be public https addresses.