Security alert emails for admins
The emails your centre's admins get about unusual sign-ins and sensitive changes, and what to do when one arrives.
Updated 18 October 2026
Why this exists
If an account at your centre is being misused, the sooner someone knows, the less harm is done. Security alert emails tell your admins and owner straight away about the riskiest changes, and sum up the rest each morning and each week. You can check something unusual while it still matters.
Your centre's admins and owner are emailed when something happens at the centre that could mean an account is being misused. The emails come from your centre's email, so they only go out once email is connected.
Straight away
You are emailed within minutes when:
- someone keeps failing to sign in to one address, or from one internet address, many times in a short window;
- a role is changed to or from admin, owner or finance, or many roles are changed at once;
- someone's two-step sign-in is reset or turned off;
- a large export of families, children, staff or the audit log is made.
Each morning, only when there is something
A daily email lists the other sensitive changes (permissions, sign-ins switched off or on, child accounts closed, View as, other exports) and any staff sign-in that was unusual: between 11pm and 5am on your centre's clock, or from outside Australia.
Every week
On Monday, a weekly summary, sent even when it was a quiet week.
When an alert arrives
- Read who did what and when.
- If you recognise it (a colleague exporting a report, a new admin you appointed), there is nothing to do.
- If you do not, check the person under People > Logins and roles. You can switch their sign-in off straight away, and reset their two-step sign-in.
- Look through Safety > Audit log for anything else they did.
Good to know
- Each alert is sent once.
- Alerts never include a password or a code.
- Every alert is about your own centre only.