Security
We hold the credentials your users sign in with. That is the most sensitive thing a company can be trusted with, and it is the whole product — not a layer we added later.
This page describes what we actually do today. Where we have not yet earned a certification, it says so.
Nothing sensitive sits in the clear
Everything we hold that could hurt someone if it leaked is encrypted before it reaches storage. What differs between them is whether we kept a way to read it back, and that difference is deliberate.
Credentials
Passwords, refresh tokens
They go through a one-way function before they are stored. We can check a password someone types against the stored value, but nothing turns that value back into the password — not us, not anyone who walks off with a copy of the table.
Secrets
API keys, OAuth client secrets, bot-check keys
Encrypted before they reach the database, never stored as you typed them. A key exists here, because we have to send these on to the provider they belong to.
Cache
Whatever is held briefly between requests
Encrypted before it is written, with a separate key derived for each record and a key ring that rotates. One key never unlocks everything.
Credentials never reach our logs either. The gateway records an explicit allow-list of request headers, so Authorization and API keys are excluded by construction rather than filtered out afterwards.
The rest of the mechanism
Every measure below is running in production today. None of it is a roadmap item.
Proving it is them
A password is one factor. Second factors are time-based one-time codes and SMS, with recovery codes for a lost device. Sudo mode covers the actions that deserve more than a valid session — changing credentials, managing factors, revoking sessions. It re-asks for proof and expires on its own, so a session left open on a shared machine cannot be used to take the account over.
- TOTP
- SMS codes
- Recovery codes
- Sudo mode
Slowing an attacker down
Five auth actions are throttled per IP address, and the limits are yours to set per environment. The lookup limit matters more than it looks: an unthrottled identifier check is an account enumeration endpoint. A bot check sits in front of the endpoints that get hammered first.
- Sign-ins
- Token refreshes
- Verifications
- Sudo requests
- Identifier lookups
In transit
Everything is served over TLS with HSTS. Responses carry the headers that stop a browser making its own assumptions: no MIME sniffing, no referrer leakage, and a content policy that blocks framing and outside resource loading. Any response carrying a token answers no-store, as RFC 6749 and OpenID Connect Core require — the only exceptions being the discovery document and the JWKS, which every client fetches constantly and which contain no secrets.
- TLS and HSTS
- CSP
- Referrer-Policy
- nosniff
- no-store on tokens
One environment cannot reach another
Each environment of a project is a separate authorization server with its own issuer and its own OAuth clients. A client registered in staging does not exist in production. That is what lets you hand a partner staging credentials without giving them anything that works against real users.
- Issuer per environment
- Clients per environment
- Data per environment
What we record
Every request through the gateway is logged with its method, path, host, status, size and timing, plus the client IP and user agent and the project, environment and session it belongs to. Sensitive query parameters are masked before the entry is written. These logs belong to the customer whose project the request hit, and are readable in the Console.
- Free 24 hours
- Pro 7 days
- Scale 28 days
- Enterprise custom
Card details we never see
Payments run through Stripe. Card numbers are entered into fields Stripe serves and never reach our systems, so there is no cardholder data here to lose.
- Stripe-hosted fields
- No card data stored
Who else touches it
We run on infrastructure we do not own, and we name it.
| Sub-processor | Activity | Location |
|---|---|---|
| DigitalOcean, LLC | Database, cache and message broker for the platform | United States |
| Cloudflare, Inc. | Edge network and API gateway | Global edge network |
| Vercel Inc. | Hosting and content delivery for the public website | Global edge network |
| New Relic, Inc. | Application performance monitoring and error telemetry | United States |
| Stripe, Inc. | Payment processing for paid plans | United States |
| Lark Technologies Pte. Ltd. | Fallback transactional email, used while no custom sender is configured | Singapore |
We give at least thirty days’ notice before adding or replacing one, and you may object. The full commitment is in the Data Processing Addendum.
Where we stand
We hold no security certification today. SOC 2 and ISO 27001 need an accredited auditor and a period of observed operation, which a platform this young cannot have yet — when we hold one, this page will link to the report rather than describe it. What follows is what is true now, and what kind of claim each one is.
GDPR
The European regulation. No certificate exists for it; what exists is the instrument.
The Data Processing Addendum carries the Standard Contractual Clauses, module two, and the UK Addendum. The sub-processor list names every provider, its activity and where it sits.
How GDPR applies hereLGPD
The Brazilian data protection law. It is the one that governs us — we are a Brazilian company.
Legal bases, data subject rights, retention and the ANPD as the authority are all set out in the Privacy Policy. International transfers use the mechanism article 33 allows.
How LGPD applies herePCI DSS
The card industry standard.
Card numbers are typed into fields Stripe serves and go straight to Stripe. Our code never sees them and our database never stores them, so there is no cardholder data here to protect.
How we stay out of scopeFound something?
Write to us. Our disclosure policy sets out what is in scope, what we ask of you, and what we commit to in return — including that research done in good faith within it is authorised.
Read the disclosure policy- Contact
- [email protected]
- Machine-readable
- /.well-known/security.txt