Sessions are stored server-side. Audit log entries record the email of the signed-in user; do not share access.