Sign-in questions, answered
Fourteen of the most common questions we hear about Ally sign-in. For cabinet-usage questions (booking, video, notes, billing) see FAQ · Cabinet.
Why is there no password?
Passwords get reused across sites, phished, and leaked in third-party breaches. A magic-link flow removes the class of attack entirely — the only credential is temporary access to your email. Ally combines this with optional TOTP 2FA for accounts that want a second factor.
How long does the magic link stay valid?
Thirty minutes from the moment we send it. After that the token is dead and clicking the link returns you to the sign-in page.
Can I share the link with a colleague?
Technically the first click wins — the link is single-use, so a colleague clicking after you get nothing. But please don't; the whole account model assumes one person per cabinet. Team plans exist for groups.
How long does the session cookie last?
Thirty days if you ticked "keep me signed in" at the sign-in page; browser-session only otherwise. You can revoke any active session from sessions & devices.
What if my company blocks magic-link emails?
Some corporate scanners consume the single-use token during automated inspection. Fix: request the link to a personal email, or ask IT to allow-list notify@allyhub.org and allyhub.org.
Can I use Ally on multiple devices?
Yes — sign in on each device separately with a magic link. All active sessions are listed in sessions & devices, and you can revoke any of them individually.
Does 2FA replace the magic link?
No — 2FA is a second step after the magic-link click. You need the email (for the link) and the authenticator app (for the code). See 2FA settings.
I lost my authenticator — how do I get back in?
Use one of the eight recovery codes downloaded when you enabled 2FA. If you don't have them, use the DPO fallback described in how to recover your Ally account.
What happens on a public / shared computer?
Untick "keep me signed in" — the session cookie is discarded when the browser closes. Better: sign in from a private window so cookies and history are dropped automatically.
Does Ally store my IP address?
The most recent IP per session is stored to display on the sessions & devices page and to detect unusual sign-in patterns. Full IP history is not retained. See UK privacy notice.
Can Ally staff see my magic link?
No. The token is one-way hashed server-side; only the version in your email is usable. Ally staff cannot generate a link for someone else, and cannot impersonate a client from the admin console.
Do you support SSO / SAML?
Not yet on personal plans. Ally Business plans include SSO-ready email invitations; full SAML/OIDC integration is on the roadmap for the coming release. See changelog.
How do I delete my account?
Open account deletion, enter your account email, click the confirmation link in your inbox. Purge completes within 30 days under UK GDPR.
My magic link never arrives — what now?
See the eight common causes in how to sign in to Ally. If none apply, email support@allyhub.org from a different address and we investigate.