## **🔍 Overview**

If you notice projects, users, or changes in your account that you did not initiate, treat it as a potential security incident and act quickly. This article walks you through how to identify suspicious activity, secure your account immediately, and escalate to our team for investigation.

## **⚠️ Signs of Unauthorized Account Activity**

Common indicators that your account may have been accessed without your permission include:

- Projects appearing in your account that you or your team did not create
- New team members or users you do not recognize
- Changes to settings, integrations, or connected properties you did not make
- Unexpected email notifications about account changes
- Activity in connected tools (such as Google Search Console) that you did not trigger

## **🛠️ Step 1 — Secure Your Account Immediately**

Before investigating, take these steps to limit further unauthorized access:

1. **Change your password immediately.** Use a strong, unique password that you have not used on any other platform.
2. **Enable two-factor authentication (2FA)** if it is not already active on your account.
3. **Review active team members.** Go to the top-right avatar menu and select **Team Members** (or navigate to **/settings**). Remove any users you do not recognize or did not invite.
4. **Revoke any API keys** that may have been issued without your knowledge, if accessible in your account settings.
5. **Sign out of all active sessions** to force any unauthorized sessions to end.

## **🔎 Step 2 — Identify What Changed**

After securing your account, document the suspicious activity so our team can investigate effectively:

- Note the names and dates of any projects you did not create
- Record any user accounts or email addresses that appear unfamiliar
- Screenshot any settings or integrations that look altered
- Check your email inbox for any Search Atlas notifications you did not expect, including invitations sent to unknown recipients

The more detail you can provide, the faster our team can trace the source of the activity and take action.

## **👥 Step 3 — Audit Your Team Members**

A common source of unexpected account activity is an unrecognized user with access to your workspace. To review and manage your team:

1. Click your **avatar** in the top-right corner of the platform.
2. Select **Team Members** from the dropdown menu, or go directly to **/settings**.
3. Review the full list of users, their roles, and access levels.
4. Remove any user you did not invite or no longer recognize by selecting the appropriate option next to their name.

If you find a user with **view-only access** that you did not invite, remove them immediately and report this to our support team for further investigation.

## **🚨 Step 4 — Report the Incident to Our Team**

Once you have secured your account and documented the suspicious changes, contact our team right away. We can investigate the origin of the activity, review access logs, and take additional protective action on our end.

If you need further assistance, open the chat widget in the bottom-right corner of the platform and type **human teammate** to be connected with a member of our team.

When you reach our team, please share:

- A description of what you observed and when you first noticed it
- Screenshots or names of unrecognized projects, users, or changes
- Whether you have already removed any unauthorized users or changed your credentials

## **💡 Best Practices to Prevent Unauthorized Access**

Reduce the risk of future incidents by following these security best practices:

- **Use a unique, strong password** for your Search Atlas account — do not reuse passwords from other services.
- **Enable two-factor authentication** on your account and encourage all team members to do the same.
- **Audit your team members regularly**, especially after offboarding employees or ending agency relationships.
- **Be cautious with API keys** — only share them with trusted integrations and revoke any that are no longer needed.
- **Monitor account notifications** — unexpected emails about your account are often the first sign of unauthorized access.