Sessions
Every signed-in device is a separate session. You can revoke any one of them, or sign out everywhere at once.
Activity log
Sign-ins, password changes and verification outcomes are recorded. If a refresh token is ever replayed, the whole session is revoked automatically, because a replay means the token was captured.