TravelFlow signs you out automatically if you stop using it for a while, and in any case 12 hours after you signed in. Before an idle sign-out you get a warning dialog with a countdown, so you can keep working without losing what is on screen. This article explains how the idle timer works, why you might be signed out on one device but not another, and what to do when it catches you mid-task.
How Long You Have
The idle timeout is set for everyone by a super admin, on the Session Timeout card under Settings > General Settings. Until one is saved there, the built-in timeout of 30 minutes of inactivity applies. Whatever value is saved, TravelFlow keeps it between 5 and 480 minutes, so the shortest possible timeout is five minutes and the longest is eight hours.
An organisation admin can set a shorter time for everyone in their organisation, under Idle sign-out on the organisation's Security page. A longer organisation time has no effect: the shorter of the two always applies. There is no per-user “remember me” or “keep me signed in” option.
The one exception is for super admins. On the Security tab of their own profile, a super admin can turn on Never sign me out for inactivity. It is off until they turn it on, so every super admin follows the timeout by default. Each change is recorded in the audit log, and nobody else sees or can use the option. It does not lift the 12-hour limit below.
What Counts as Activity
The timer resets on any of the following, anywhere in the app:
- Moving the mouse
- Pressing a key
- Touching the screen
- Scrolling
Coming back to TravelFlow is not activity. When you return to a tab, bring the window back into focus or unlock your phone, TravelFlow works out how long you were away; if that is longer than the timeout, you are signed out at once rather than given a fresh start.
Activity is shared between tabs. If you have TravelFlow open in three tabs and you are working in one of them, all three stay signed in. A super admin can turn this off with the Cross-tab activity sync setting, after which each tab keeps its own idle time.
The Warning Before an Idle Sign-Out
Shortly before the timeout (60 seconds unless a super admin has set another warning time, between 10 and 120 seconds), a dialog titled Session Expiring appears over whatever you are doing. It reads “Your session will expire in N seconds due to inactivity”, with the number counting down each second.
- Click Stay Logged In to reset the timer and carry on. This also resets the timer in your other TravelFlow tabs.
- Click Log Out to sign out immediately — useful if you are stepping away from a shared machine.
- Do nothing and the countdown runs out. You are signed out and shown Session Expired — “Your session expired due to inactivity. Please sign in again.”
The dialog has only those two buttons — clicking the dark background behind it does not dismiss it. Note that mouse movement over the dialog itself counts as activity, so simply moving the pointer towards the buttons already cancels the warning.
A Sign-In Lasts 12 Hours
However active you are, a sign-in lasts 12 hours from the moment you gave your password. Then you are signed out with the message “You have been signed in for 12 hours. For your security, please sign in again.” This applies to everyone, including super admins who are never signed out for inactivity. Changing your password signs you in afresh, so the 12 hours start again.
The server enforces the same limit, so a session copied from your device stops working after 12 hours too. After a password change, a deactivated account or a removed two-factor device, every other session stops working within about a minute.
Server-Side Session Checks
Separately from the idle timer, TravelFlow checks with the server shortly after a page opens and then roughly every five minutes that your session is still valid. If the server says it is not, you are signed out straight away under Session Expired with “Your session is no longer active. Please sign in again.” — there is no warning for this kind of sign-out.
This can happen when:
- Your password was changed on another device. That ends every other session so all your devices sign in again with the new password.
- Your account was deactivated, or an administrator removed your two-factor device.
- The server-side record of your session has had no contact for an hour — for example a laptop that was closed with a TravelFlow tab open.
If the check itself cannot reach the server — you are offline, or on a flaky connection — you are not signed out. The check fails safe and simply retries at the next interval.
After You Are Signed Out
- The message saying why you were signed out is shown.
- Sign in again from
/auth/login. - When the sign-in page was opened with a link back to the page you were on, you land back there after signing in; otherwise you land on your role's normal starting screen.
Signing out also clears the booking basket, the traveller details and the unfinished forms TravelFlow keeps in that browser, so the next person to use the same machine cannot see them.
For Administrators
Super admins set the timeout on the Session Timeout card under Settings > General Settings: Idle Timeout (minutes) (5 to 480), Warning Duration (seconds) (10 to 120) and Cross-tab activity sync. Every save is recorded in the audit log. Each person's browser reads the timeout when they sign in or open TravelFlow, so a change reaches someone already signed in when they next do.
Organisation admins can only shorten the time for their own organisation, under Idle sign-out on the organisation's Security page. The 12-hour limit on a sign-in is fixed and cannot be changed in the settings.