Security, access and good practices
Reduce unnecessary access and protect invitations, reset links, and integration authorizations.
Updated
In short
Daily security relies on individual identities and access limited to real need. Regularly review members, invitations, connections, and external consents. Remove unused access, keep verification and reset links private, and authorize an integration only through its official service. Billabex support never asks for your password or token.
Expected result
Every active access has a known owner and purpose, with no abandoned invitation or connection.
Before you start
- List the people and integrations still expected.
- Schedule the review with an organization owner.
Procedure
- Review members and remove people who no longer work in the organization.
- Cancel old invitations or ones sent to an incorrect address.
- Inspect integrations and reconnect only sources you recognize.
- Revoke AI clients or consents that are no longer used.
- When in doubt, change your password from Billabex and report the event without sharing the secret.
What Billabex does
Billabex limits users to their organizations and protects invitation, OAuth, and password-reset journeys. Some sensitive changes, such as the bank-details document, also notify verified members.
If the result is not what you expected
- Do not open a connection link whose domain differs from the expected service.
- After a de facto administrator leaves, review members, connections, and consents together.
- For suspicious access, note time and user before revoking it, then contact support.