Responding to suspicious account activity

If a sign-in, password-reset message, API action or workspace change is unfamiliar, secure the account from a trusted device. Preserve useful details without delaying containment or exposing secrets.

Before you start

• Use a device you trust and secure the email account connected to Dosya.
• Record the time, visible action and affected workspace or resource. Do not copy passwords, one-time codes, recovery codes, API-key secrets or private links.
• If you cannot sign in, use the password and second-factor recovery guides first.

Steps: contain the account

1. Change the Dosya password from Profile → Password & 2FA. If locked out, request a password reset.
2. Confirm two-factor authentication is enabled and replace recovery codes if they may have been exposed.
3. Open Profile → Sessions. Identify the current session and revoke every unfamiliar device. Use the revoke-others action when appropriate.
4. Open Profile → API keys. Revoke keys you do not recognize and rotate any key stored on a lost device or exposed system.
5. Review connected integrations and AI apps. Disconnect anything unfamiliar.
6. For each important workspace, open Activity and filter around the relevant time, member and action.
7. Check members, invitation links, share links and file requests for unexpected access.
8. Contact private support with redacted evidence when the source or impact is unclear.

Expected result

Unfamiliar sessions and credentials no longer provide access. New sign-ins require the changed password and current second factor. Workspace activity and current resource state give you a bounded view of recorded actions to include in a support case.

Limits and investigation boundaries

• Session revocation does not revoke API keys, and API-key revocation does not end browser sessions.
• Password changes do not undo file, link, member or settings changes already completed.
• The activity log records supported events and metadata; it is not a file-content inspection tool or complete forensic guarantee.
• IP geolocation can reflect a VPN, proxy, carrier or corporate gateway.
• Vault keys and unlock state have separate recovery and destruction boundaries.
• Never post incident evidence containing private URLs, IP addresses or account identifiers publicly.

Troubleshooting

I cannot access the account. Secure the email inbox, reset the password and use a saved recovery code if authenticator 2FA is enabled.

I lost a device. Revoke its session, rotate keys stored on it, disconnect integrations it authorized and review recent workspace activity.

An unfamiliar member joined. Revoke active invitation links, remove the member, review role and folder changes, and preserve the activity timestamps.

Files or settings changed. Use the appropriate restore or administration workflow. The activity log itself does not reverse changes.

Support needs evidence. Provide the approximate time, account email, workspace name, action, outcome and any request or session ID through private support. Keep all secrets out of the ticket.

Related guides

• Reviewing active sessions
• Creating and managing an API key
• Reading workspace activity and audit details
• Contacting support with useful information