Under “Security checks”, a hotel sees who logged in when and from where, and which accesses to ReGuest exist. An access that is no longer needed or is unknown can be ended there immediately. The menu path is Settings › Data Protection and Privacy › Security checks.
Example: Find and end an unknown session
Open the page. Settings › Data Protection and Privacy › Security checks opens the tab “Access tokens”.
Filter for active accesses. The “Status” filter first shows “All statuses”; selecting “Active” shows only the accesses with the status “Active”.
Hide your own office address. Enter the office's IP address in the “Hide IP addresses” field. The rows with this address disappear from the list, and a notice shows how many rows are hidden.
Check the remaining rows. The columns “User”, “Type”, “Country”, “IP address” and “Browser” show who is logged in with which access from where.
End the session. In the row of the unknown access, “End session” opens the confirmation prompt “Are you sure you want to end this session? The access stops working immediately afterwards.” The “End session” button in the prompt confirms.
Result. The access has the status “Forced logout” and stops working immediately. ReGuest records which user ended the session.
The pages in detail
The page has two tabs, “Access tokens” and “Login attempts”. An entry cannot be deleted on either of the two tabs.
Access tokens
The tab lists every session and every technical access: logins to the Backoffice as well as accesses for interfaces, “MS Outlook Add-in” or “Mobile App”. The columns are “User”, “Status”, “Type”, “Origin”, “Validity”, “Country”, “IP address”, “Browser” and “Browser identifier”. If an access has no expiry date, the “Validity” column shows “Does not expire”.
The “Status” column shows:
“Expired”: the access's expiry date has passed without anyone logging out.
“Logout”: the user logged out themselves.
“Forced logout”: the session was ended, for example with “End session”.
“Consumed”: a single-use login token was redeemed for an automatic login and cannot be used again.
“End session” appears for every active access except your own session.
Login attempts
The tab shows every login attempt, successful or not. The columns are “Date”, “User”, “Outcome”, “Source”, “Country”, “IP address”, “Browser”, “Language”, “Browser identifier” and “Reason”. If there is no account behind the user name entered, the “User” column shows the name entered. The “Reason” column is filled only for entries with the failure reason “Second factor reset”.
Failure reasons are, for example, “Invalid password”, “User not found” or “Two-factor code invalid”. Sources are, for example, “Backoffice”, “MS Outlook Add-in”, “API” and “Mobile App”.
Hiding and period, on both tabs. “Hide countries” and the “Hide IP addresses” field remove rows from the list, for example those of your own office address. The “Hide IP addresses” field accepts single IPv4 and IPv6 addresses and IPv4 ranges with /8, /16 or /24; countries are selected under “Hide countries”. A notice shows how many rows are hidden; “Show” displays them again. The selection is not saved anywhere. Without an entry in the “Period” filter, both tabs show the last 30 days, newest entries first. With a period you choose yourself, they go back as far as you like, because access tokens and login attempts are not removed automatically.
Prerequisites
‘Security checks’ does not need a licence module of its own.
Access to ‘Security checks’ is enabled for specific users through their role. Roles are managed by ReGuest support.
Frequently asked questions
Why is the “Security checks” menu item missing? The user's role does not enable it. Access to the other data protection pages is not enough for it. Roles are managed by ReGuest support.
Why is there no “End session” for a session? The button appears only for active accesses and never for your own session. Your own session ends when you log out yourself.
How do I log out someone else's device? On the “Access tokens” tab, with “End session” in the row of the access.
Does the office address have to be hidden again every time? Yes. The selection under “Hide countries” and “Hide IP addresses” is not saved anywhere.
How far back do the lists go? Without an entry in the “Period” filter, the last 30 days. With a period you choose yourself, as far back as you like, because the entries are not removed automatically.
Why does the “User” column show a name that does not exist in the hotel? For a login attempt with no matching account, the column shows the name that was entered.
Can an entry be deleted? No. An entry cannot be deleted on either of the two tabs.
As of: 2026-10-29.