Run a Monthly Account and Device Relationship Review
A monthly review confirms account ownership, expected supported screens, available session evidence, recovery readiness, shared-device rules, and billing responsibility without collecting secrets.
In short: Once a month, confirm the account and billing owners, list the supported screens the household still expects to use, and compare that list with any session or device information currently available through official controls. Review shared-screen handling, recovery readiness, and unexplained activity. Record broad device categories and actions, never passwords, codes, private source details, serial numbers, or a presumed control that is not documented.
A monthly review should be short enough to repeat. Its job is to find forgotten screens, unclear ownership, and early signs of account confusion before a security event forces a larger audit. It is not a detailed viewing-history review.
Start from the maintenance calendar
Use the maintenance handbook to keep this monthly task separate from quarterly profile hygiene and event-driven security work. Set one recurring date and one administrator.
Record the last review date, current account email in a redacted form, and the subscription provider role without copying payment details.
Confirm ownership
Name the people responsible for the Norva account, billing through the original provider, connected-source administration, and household support. These may be different roles. Confirm that each role still has a lawful, practical recovery path.
If ownership changed, stop the light review and use the household-change profile audit plus the appropriate account and source handoff processes.
Build an expected-screen list
List broad categories such as personal mobile, household TV, and private browser. Add a neutral household label, primary user role, current or retired status, and last confirmed month. Do not store serial numbers, advertising identifiers, precise locations, or screenshots of private settings.
Profile capacity must not be converted into a device limit.
Compare only available official evidence
If current Norva account controls expose session or device information, compare it with the expected list. Record exactly what is visible and the review date. If no such control is documented, do not claim one exists; use official support for a material concern.
An unfamiliar label can reflect a changed browser or device description, so classify it as unexplained rather than compromised until evidence supports that conclusion.
Review shared screens
For each shared browser or TV, confirm who owns the session, whether the screen remains in the household, and who may change account, source, or profile settings. Sign out through current official controls when a screen leaves your control.
Do not distribute a password merely because several profiles share one screen. The new-account security guide covers unique credentials and phishing boundaries.
Check recovery readiness
Confirm that the account email remains controlled, the password-manager record exists, and any recovery options currently offered are understood. Do not copy recovery codes or answers into the monthly register.
If access is already uncertain, use the official support route rather than experimenting with repeated password changes.
Verify billing responsibility
Record the original subscription provider, billing owner, next known review or renewal date, and where the current official cancellation instructions live. Conditions may vary by provider. Do not store card numbers, invoices with personal data, or unsupported refund assumptions.
This check catches accounts that continue after the household administrator changes.
Classify anomalies
Use expected, retired, unexplained, or not visible. Every unexplained result needs an owner, timestamp, evidence source, and next action. A suspected exposure should trigger password and recovery action through official controls, followed by the post-password device audit.
Do not delay a credible security response until the next monthly review.
Close and minimize evidence
Mark each action completed, escalated, or accepted with reason. Keep only the relationship register needed for administration. Delete temporary screenshots and never retain secrets. Review the storage location and access list for the register itself.
Original evidence: monthly relationship register
| Role or screen | Expected status | Official evidence available | Finding | Action owner | Closed |
|---|---|---|---|---|---|
| Account owner | |||||
| Billing owner | |||||
| Personal mobile | |||||
| Shared TV | |||||
| Private browser |
Common mistakes and limitations
- Inventing a session dashboard that is not documented.
- Storing unique device identifiers.
- Treating an unexplained label as proven compromise.
- Confusing profile count with device count.
- Forgetting the original billing provider.
- Waiting for a monthly date during an active concern.
Frequently asked questions
Does Norva guarantee a complete trusted-device list?
Do not assume one. Use only session or device information currently available through official controls and contact support for material gaps.
Should I change my password every month?
Not as a ritual. Use a unique managed password and change it when exposure, policy, or another justified trigger requires action.
How much device detail belongs in the register?
Use the minimum needed to distinguish expected household screens: broad category, neutral label, owner role, and status.