Signing out and security
How to sign out, how sign-in works, what is encrypted, who can see what, and how to close your account.
Signing out
Sign out from the user menu at the bottom-left of the sidebar, then Log out.
Sign out from any shared or borrowed machine. A session persists in the browser until it is signed out.
Sign-in
Sign-in is passwordless: an email code, an SMS code, or a passkey. There is no password to remember, reuse, or leak.
Passkeys are the strongest of the three and the fastest. Add one under Settings, and add more than one if you use more than one device. Losing the only device holding your only passkey leaves you dependent on email or SMS to get back in.
What is encrypted
- Bank details are encrypted at rest. After saving, only the last 4 digits are displayed back, including to you.
- Client documents move through BlockWill's encrypted storage, scoped to the client they belong to.
Who can see what
| Can see | |
|---|---|
| Your team members | Only the clients you delegate to them. Not your earnings, not your profile, not your other clients. |
| Your clients | Their own documents and requests. Never your internal notes, never your messages with BlockWill. |
| BlockWill | Your assignments and your conversation with BlockWill. Not your internal notes, and not your messaging with your own clients. |
| Counsel in the network | The brief only, unless the owner grants a per-handoff release. See Referral partner. |
Internal notes and Messages are both hidden from the client, but they are not the same thing. Internal notes stay with you and your team. Messages go to BlockWill.
Access you no longer have
If a flow is disabled on your account, the pages under it stop working immediately. Navigating to one directly shows a "not enabled" card rather than the data. The same check runs on the server, so a stale browser tab cannot be used to reach a flow you no longer hold.
Sensitive actions are recorded in an audit trail against your account, including opening a counsel brief.
Closing your account
Settings → Delete Account requests full deletion of your partner account and data, under GDPR Article 17.
Deletion is irreversible. Export anything you need first, and settle any outstanding payout before requesting it.