Protect Accounts When Staff Share a Mobile Device

SECTION 01

Choose what survives a shift change

List local records, images, drafts, search history and downloaded files. Decide which are reusable device resources and which belong to a specific account. Show pending work before logout, with an explicit choice or approved policy for saving, submitting or discarding it. Do not automatically erase unsent work without explaining the consequence.

OWASP's mobile-storage control covers protecting sensitive local data. Its session guidance also distinguishes server-side invalidation from merely changing the visible screen. The precise implementation differs between native apps and embedded web views, so require the agency to inventory both rather than assuming one logout call handles every component.

SECTION 02

Illustrative example: a warehouse shift handover

A morning worker photographs a damaged package while offline and then ends their shift. The afternoon worker signs in on the same phone. The image and draft belong to the morning worker's task, not the afternoon worker's account. The app must not silently upload them under the new identity.

The agreed design might require the first worker to resolve pending work before handover, or securely isolate it for later authorized recovery. The next worker sees only their permitted jobs. A stale notification for the first account opens a signed-out or access-denied route without revealing the previous record. This example makes the tradeoff between continuity and privacy explicit.

SECTION 03

Verify after crashes, restarts and lost connectivity

Test logout during an upload, a process killed before cleanup finishes, device restart and switching back to the original account. Inspect cached screens and downloads as well as API access. Confirm that expired credentials cannot be revived by an old queue or an embedded browser session.

Handoff should identify session owners, local-storage boundaries, pending-work policy and lost-device procedures within the agreed support scope. Separate accounts can add friction to rapid shift changes, but a generic shared login removes accountability. Choose the operating model deliberately and validate it with the staff who will actually hand the device over.

SECTION 04

Frequently asked questions