> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alethiaai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Account Settings

> Manage your profile, password, sessions, and security preferences.

Your **account** is your individual identity in Alethia. It's separate from any team or organization — you can be a member of multiple teams across multiple organizations using the same account.

Open your settings by clicking your avatar at the bottom of the sidebar → **Account Settings**.

## Profile

| Field             | Notes                                                              |
| ----------------- | ------------------------------------------------------------------ |
| **Display name**  | Shown next to your overrides, comments, and audit log entries      |
| **Email address** | The address you log in with (changing it requires re-verification) |
| **Avatar**        | Upload an image or use your initials                               |
| **Job title**     | Optional — helps team members know who's who                       |

## Password

<Steps>
  <Step>Go to **Account Settings → Security**.</Step>
  <Step>Click **Change Password**.</Step>
  <Step>Enter your current password, then your new one twice.</Step>
  <Step>Save. You'll stay logged in on this device. Other sessions will be logged out.</Step>
</Steps>

If you forgot your password, log out and click **Forgot Password** on the login page. A reset link will be emailed to you.

## Single Sign-On (SSO)

If your organization has set up SSO with Google or Microsoft (or SAML), you can sign in using your work account. Once SSO is enabled at the organization level, you'll see the SSO button on the login page automatically.

You can connect or disconnect SSO providers from **Account Settings → Security → Connected Accounts**.

## Active sessions

Under **Security → Active Sessions** you'll see every device currently logged into your account, with:

* Device type (Chrome on macOS, etc.)
* Approximate location
* Last activity time

Click **Revoke** next to any session to log it out remotely. Use this if you suspect your account has been accessed without permission.

## Notifications

Choose which events should trigger an email to you:

* **Test failures** — a scheduled test failed
* **Mitigation due** — a mitigation you own is past its due date
* **Risk approved / rejected** — your risk classification or assessment was reviewed
* **New invite** — you've been invited to a new team
* **Weekly digest** — a Monday morning summary of your project activity

## Connected providers

If you've added SSO connections, they appear here. You can connect a provider you haven't used yet, or disconnect one — but you can never disconnect your **last** sign-in method (you'd lock yourself out).

## Deleting your account

<Steps>
  <Step>Go to **Account Settings → Danger Zone**.</Step>
  <Step>Click **Delete my account**.</Step>
  <Step>Read the confirmation carefully — this is irreversible.</Step>
  <Step>Type your email to confirm.</Step>
</Steps>

What happens when you delete your account:

* Your profile is removed from all teams you're a member of
* Your **work is preserved** — test runs you triggered, risk entries you created, overrides you made all stay in place, attributed to "Deleted User"
* Sessions are revoked
* Any pending invites you've sent remain valid and can still be accepted

If you're the **only Owner** of an organization, you'll need to transfer ownership to someone else first.

<Warning>
  **Account deletion does not remove your team's data.** Test runs, risk records, and audit logs stay with the team. This is intentional and required for the audit trail to remain intact.
</Warning>

## Two-factor authentication (2FA)

Coming soon. In the meantime, the strongest protection for your account is:

* A long, unique password
* SSO via Google or Microsoft (which adds your provider's 2FA on top)
* Regular review of your active sessions