How a shared sign-in is kept
An identity is one website login your team shares. It runs in one long-lived browser, in Joinpane's cloud or on a node of yours, with one IP address and one browser fingerprint for its whole life.
- We store the signed-in session, encrypted, in your workspace's home region. Northlight's, for example, is Asia Pacific, Tokyo.
- It is only decrypted on the machine running that identity, when the identity wakes. It sleeps after 15 minutes with nobody inside.
- Windows stream from that browser to each person. On strict office or hotel networks the stream goes through a relay, still encrypted.
Passwords
A password is typed once, by the person signing in, into the website's own page. It goes from their keyboard to the website.
- Joinpane never stores it. The identity's browser doesn't save passwords, and we keep only the signed-in session.
- Nobody can read one back, including your admins and Joinpane staff. There is nothing to reveal.
- Teammates watching see dots. On phones, password fields are never echoed to anyone else.
Who sees what
Everyone inside an identity, person or agent, has their own window. Each window is private until its owner shares it.
- Watchers are read-only. To click or type in a shared window they ask to take over, and the driver can say no.
- Viewers can't copy out. They watch, and can't click, type, download or copy text to their own computer.
- Admins can mark pages as admins only, like /settings/password or /billing. Members are stopped before those pages and told why.
| Role | Own window | Watch shared | Files | Copy text out | Admins-only pages |
|---|---|---|---|---|---|
| Admin | Yes | Yes | Yes | If the policy allows | Yes |
| Member | Yes | Yes | Yes | If the policy allows | Stopped |
| Viewer | No | Watch only | No | Never | Stopped |
Sign-in codes and phone owners
When a website wants to check it's really you, it texts or emails a code to the phone or inbox on the account. That phone belongs to someone on your team, never to Joinpane.
An admin names the phone owners for each identity: the people who hold that phone. When the website asks, we reach them in this order.
- A notification in the Joinpane app. They can type the code right into it.
- An email after 2 minutes without an answer. It links back to the same request.
- Telegram or a webhook, if you set one up. Each person chooses their own.
Anyone inside the identity can also type the code straight into the website's page. Codes usually last 10 minutes; if one runs out, ask the website for a new one. Joinpane never reads your texts. A code reaches the website only when a person types it.
Agents
Agents connect through MCP or the API with a key. Each gets its own window with a dashed frame and is always labelled as an agent, so everyone can tell who is acting.
- They never get cookies or passwords. They see pages and press buttons; the session stays in the browser.
- They ask a person before publishing, paying, changing settings or deleting, and wait for the answer.
- They can't type into password fields unless an admin allows it. When a website signs one out, it waits for a person.
- They pause when a person takes over and pick up again after the person hands back.
Uploader wants to publish Episode 13 on studio.example. Northlight asks a person before agents publish.
The record
The audit log records who opened, drove, downloaded and changed what, in which identity and from where. Agents appear under their own name and key. Nobody can edit an entry, admins included.
- 14:08Ana Torres signed in with a code entered by Rin KatoAd account
- 14:06Rin Kato took over from Mei Lin after she said yesStudio uploads
- 13:55Uploader sent ep12_final_cut.mp4 from Drive to the websiteStudio uploads
- 13:40Mei Lin downloaded uploads-report-oct.csv to DriveStudio uploads
Every paid plan keeps an audit log. Pro keeps it for a year and exports it as CSV.
Your own hardware
A node is a machine you run that hosts identities instead of Joinpane cloud. Use one when a website should see your office line, or when sessions must stay on your hardware. It starts with one Docker command.
docker run -d --restart unless-stopped --name joinpane-node \
-e JOINPANE_TOKEN=your-node-token \
joinpane/node:1.4.2- Outbound HTTPS only. The node calls Joinpane and nothing calls in, so there is no port to open on your network.
- The browser and its session live on your machine, and websites see your node's own address.
- If a node goes offline, its identities wait for it. They never move to the cloud by themselves.
Data and deletion
Data lives in the home region you pick when you create a workspace. Here is what we keep, and for how long.
- Passwords
- Never stored.
- Signed-in sessions
- Until you remove the identity. We delete its session right away; the account at the website stays yours.
- Drive files
- Removed after 30 days by default. Admins can choose 90 days, or keep files until someone deletes them.
- Audit log
- 1 year on Pro.
- A deleted workspace
- Can be restored for 14 days. Then it is gone, with its sessions, Drive and audit log.
Admins can export everything at any time: a zip of the audit log, the Drive file list and settings. Sessions and passwords are never exported.
Responsible use
Joinpane makes it easy to share an account. Whether you may share it is between you and the website.
You follow each website's terms
You're responsible for following the terms of every website you add, including whether its accounts may be shared. Some sites welcome team logins and some forbid them. Check before you add an identity.
We never get around a website's checks
Joinpane never bypasses a website's security. When a site asks for a human check, a person solves it in their own window. Sign-in codes come from your own phones.
One account, one place
An identity keeps one IP and one browser for its life. We don't rotate addresses or disguise browsers to hide who is using an account.
Misuse ends the identity
Identities used for spam, fraud or to get around a ban are shut down, and we tell the workspace's admins why. Repeated misuse closes the workspace.
Reporting a vulnerability
If you find a security problem in Joinpane, email us what you found and how to reproduce it. We confirm within 2 working days and keep you posted until it's fixed.
- Test against a workspace of your own. The Free plan is enough.
- Don't open other customers' data, slow the service down or publish details before we've fixed it.