5. Machines

Your account is one thing. The computers you run it on are another, and Clout keeps them apart on purpose: a computer is something you add, watch and take away, and taking one away does not touch a single profile.

Signing in on a second computer

There is nothing to pair and no code to type. Install Clout on the second computer, open it, and sign in.

The app does not ask for your details in its own window. It opens your system browser at app.cloutlabs.co, you sign in there the way you did the first time, and the browser hands a one time code back to the app. That is deliberate: a sign-in form drawn inside an application is the shape every credential phish takes, and there is nothing you can check about it.

That moment is when the computer joins your account. It appears under Devices in the portal, with the name it gave, its operating system, where it signed in from, and when it was last heard from. Nobody has to approve it.

Until you are signed in, the app shows the sign-in screen and nothing else. The fleet, the sidebar and every dialog are not merely hidden, they are not there, and signing out puts the window back to that screen.

Your plan counts computers

Every plan carries a number of computers that may be signed in at once (Starter is two, and each step up carries more; the current numbers are on cloutlabs.co/pricing and in the portal under Subscriptions). When you are at the limit, the next sign-in is refused with the number in the sentence:

Your plan covers 5 computers and you are using all of them. Remove one under Devices, or move to a larger plan.

Remove one you no longer use and the sign-in goes through.

Some computers arrive twice

A physical machine publishes an id the operating system holds, so Clout recognises it again after you reinstall the app. A virtual machine or a container often publishes nothing stable, so the app binds to a random id it keeps in its own data directory. Wipe that directory and the same computer arrives as a new device row. The Devices screen marks which of the two a machine is, so a duplicate is explained rather than mysterious.

Connecting a computer to your account's fleet

Signing in registers the computer. Syncing is a second, separate step, because the two use different credentials: your sign-in belongs to you, and the sync key belongs to the machine and never leaves it.

In the app, open Account, find This computer, and press Connect. The app mints a one time enrolment code for itself and spends it immediately. You never see the code, because there is nothing for you to do with it.

The row then says one of these, and each one has its own remedy:

The one hour matters. A connected computer that cannot reach us keeps working from what it holds for sixty minutes, then stops opening anything new. Browsers that are already open are not touched, and anything mid way through finishes. That window is what makes losing your internet connection a pause rather than an outage, and it is also why removing a machine that is offline is not instant.

What syncs, and what does not

A connected computer pulls your account's fleet and writes it into its own local store. Twelve kinds of record travel:

groups · profiles · tags · folders · extensions · extension attachments · proxies · proxy pools and their members · templates · account settings · saved logins, without their secrets

Deletions travel too, and they arrive in the order that keeps them consistent: a folder before the profile filed in it, a proxy before the pool that holds it.

Secrets are never in that stream. Passwords, two factor seeds, proxy passwords and session cookies are not part of a sync page. A profile that needs one fetches it, one profile at a time, through a separate path that writes an audit record for every disclosure: which account, who asked, when, and which key. The point of the split is that the log has one row per actual use rather than one row per sync.

A saved login arrives without its password. The second computer shows you the site, the label, the username and the note, and leaves the password field visibly empty rather than inventing a value that would fail at the login form.

What does not travel yet, and what to do instead

• A profile you create on this computer stays on this computer. Sync brings the fleet down; nothing sends a new one up. If your fleet is on your account, it is because we put it there.
• Browsing data beyond the session (history, local storage, extension state) does not move between machines.

Until that changes, moving one profile to another computer is a deliberate act and the app has the two halves of it:

1. Export the profile on the first computer and Import the file on the second. That carries the identity, the proxy and the settings.
2. Export cookies and import them into the profile on the other side. That carries the session, which is the part that matters and the part an export of the profile alone cannot hold.

An exported cookie file is plaintext, because a session that is encrypted to us is a session nothing else can read. The app says so before it writes one. Treat that file the way you would treat the password to the account inside it, and delete it when you have finished with it.

When two computers disagree

If a profile is edited on one computer and the account's copy has moved on, the write is refused rather than merged, and the app shows you both versions and asks which one is right. Nothing about your data is decided by whichever computer spoke last.

Retiring a machine you no longer have

In the portal, open Devices and find the row. There are two buttons, and which one you want depends on whether you still trust the computer.

Sign out: the laptop somebody took

Sign out ends the machine's session and frees its slot. The row stays on the list, marked Signed out, and that computer cannot sign back in. It is one way, on purpose: a removal you can undo by opening the app again is not a removal.

Every role can do this, including the person whose laptop it was. It is the one security action on the account that nobody needs permission to perform, because the alternative is somebody waiting for an admin to wake up while their stolen laptop is signed in.

Remove: the laptop that was re-imaged or died

Remove does everything Sign out does, then takes the row off the list and releases the account's hold on the machine. That last part is the difference: the same computer can install the app, sign in, and arrive as a new device.

Use it when the machine is not a threat, it is just gone or rebuilt. A re-imaged laptop that could only ever be signed out would sit on your list forever, and until this existed, that is exactly what happened.

Removing is admin and above (devices.remove), because it edits a list the whole workspace reads and it drops that machine's profile assignments. Signing out is the security action and reaches everyone; removing is roster work.

Your profiles are untouched either way, and neither one closes a browser that is already running.

Sign-ins are not devices

Under Devices there is a second list: your own sign-ins. A sign-in is a session credential (the browser reading the portal has one, and it is not a computer at all). Signing out of a browser session does not remove a device, and removing a device does not sign out your browser. The device list is the fleet's, so an owner sees teammates' machines on it. The sign-in list is only ever your own.