XTRM tracks sessions and IP addresses. This can be seen in settings/security. If a different browser or IP is detected then you will be sent a 'One Time Password' to verify your account before being allowed to login. This is sometimes known as multi-factor authentication. (MFA)
If you are ever concerned about access to your account you can click 'Delete All' above the history of attached devices. This will ensure the one time pasword is requested at next login.