Timing is the whole value here. A sign-in you hear about immediately is a session you can end; one you find later is a month of exposure.
Nobody audits their own account. The realistic protection for a small business is being interrupted at the moment something changes, because that is the only time the information is cheap to act on.
A new-device sign-in is a good trigger precisely because it is rare and usually explainable — you know whether you just signed in on a new phone. When the answer is no, you find out in minutes.
| Limit | Starter | Growth | Scale | Enterprise |
|---|---|---|---|---|
| WhatsApp own-number message allowance (per month) | − | 2,400 messages/year | 6,000 messages/year | 24,000 messages/year |
When a new sign-in happens.
Usually it is you on a new device.
From the device list.
Separate logins beat a changed password.
Who can open the books, on which device, and what they are allowed to do once inside. Staff get accounts of their own rather than a shared password, and what each of them can reach is set screen by screen.
Most of it is set up once, early, and then only noticed when something changes — a new device signs in, a bill is cancelled, a role needs tightening.
per year
From Growth
Where you look afterwards and what you do.
The account being signed into somewhere it has not been used before.
End that session from the device list, then look at who has your credentials.
A new device is a new device — which is what makes the alert meaningful when it is not yours.
The value is entirely in when you hear about it.
