---
title: "Security notices and SMS"
description: "The security emails and text messages the console sends a console user when something changes on their account, and why they cannot be turned off."
url: "https://support.outpostplatform.com/depot/security-notices/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Mandatory security emails (subject Security alert) the Outpost console sends a console user when their account changes: new device sign-in, password or email change, two-factor on or off, recovery code used, role change, account disabled or enabled. Password change, email change, and two-factor turned off also send an SMS to a verified phone number."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/security-notices.md"
license: "CC BY 4.0"
---

# Security notices and SMS

When something changes on a console account, Outpost tells the person whose
account it is. These security notices go by email to the account's address,
and the three most serious also go by text message. They exist so that someone
whose account was taken over hears about it, even when the change was made by
whoever took it over.

Security notices are mandatory. There is no setting to turn them off, and they
carry no unsubscribe link.

## What triggers a notice

| Notice | Sent when | Also by SMS |
| --- | --- | --- |
| New sign-in to your account | Someone signs in from a device or network the account has not used before. | No |
| Your password was used to sign in | The correct password is entered from a new device or network on an account with two-factor authentication, and the sign-in is waiting for the second factor. | No |
| A password was set on your account | A password is set on an account that had none. | No |
| Your password was changed | The password is changed. | Yes |
| A password change was attempted on your account | Someone signed in to the account entered the wrong current password while changing it. Sent at most once an hour. | No |
| Your account email address was changed | The account's email address is changed. Sent to the old address as well as the new one. | Yes |
| Two-factor authentication was turned on | Two-factor authentication is turned on. | No |
| Two-factor authentication was turned off | Two-factor authentication is turned off. | Yes |
| A recovery code was used to sign in | Someone signs in with a recovery code. | No |
| Your account permissions were changed | A role is granted or removed. | No |
| Your account was disabled | An administrator disables the account. | No |
| Your account was enabled | An administrator enables the account. | No |

The console also emails invitations, sign-in codes, and the code that confirms
a new email address. Those carry their own subject lines.

## What a notice says

Every notice has the subject **Security alert**, so the subject line gives
nothing away to someone who can see the recipient's screen. The message
contains:

- What happened, in one line, such as "Your password was changed".
- Which account it is about: your organization's name and the account's email
  address.
- When it happened, in UTC, and the IP address and browser it came from, where
  known.
- The closing line "If this was you, no action is needed. If this was not you,
  secure your account now:" followed by a link to the **Account**
  page.

## How notices are delivered

Notices go out through your organization's active outgoing email provider. If
that provider fails, Outpost retries the notice through its own mail service,
from Outpost's domain with your organization's name on it, so a broken provider
does not hide a warning about an account. Every notice is recorded, sent or
not. See [Configure outgoing email](/depot/email/).

## Text messages

Three changes also send a text message, because each one hands control of the
account to whoever made it, and each can be made by someone who already
controls the account's mailbox:

- Your password was changed
- Your account email address was changed
- Two-factor authentication was turned off

A text message is sent only when all of these are true:

- The account has a phone number, and that number has been verified.
- Outpost's text message service is available to your Outpost.

An email address change sends one text message, not two.

## What to do with a notice you did not expect

- Change your password on the **Account** page.
- Turn on two-factor authentication if it is off.
- Read **Recent activity** on the same page for anything else you do not
  recognize.
- Tell an owner, so they can check the [audit logs](/depot/audit-log/) and,
  if needed, disable the account.

See [Manage your console account](/depot/account-security/).

## Related

- [Manage your console account](/depot/account-security/)
- [Configure outgoing email](/depot/email/)
- [Audit logs](/depot/audit-log/)