Security
Signing in
- Passkeys, with user verification required, so a stolen device alone is not enough.
- Two step verification with any authenticator app, plus single use recovery codes.
- Passwords are hashed with Argon2id and checked against known breaches when they are set.
- Repeated failed sign ins are slowed down.
- Changing your password needs the current one. Adding or removing a passkey, turning off two step verification or changing an organization role asks you to confirm it is you first.
- Our own administrators must use two step verification or a passkey.
Apps and tokens
- Apps connect over OpenID Connect. Identity tokens are signed. Access tokens can be revoked at any time and last one hour.
- Refresh tokens rotate on every use, and reuse of an old one is detected.
- Each app can be open to everyone or limited to named people, groups or organizations. Removing someone's access to an app revokes that app's tokens for them.
- When an administrator deactivates a person, every app refuses their next sign in, their AndroAccess sessions end and their app tokens are revoked at once, and apps that support sign out notices sign them out too.
Your sessions and data
- You can see where you are signed in and end any session.
- You can export everything we hold about you, or close your account, from your account page.
- Sensitive actions are written to an audit log in which every entry is chained to the one before it, so an edited or deleted entry is detectable.
Running the service
- All traffic is encrypted in transit, and pages are served with a content security policy.
- The service runs in multiple regions with automatic failover.
- The database is backed up every hour, copies are kept in more than one location, and the backups are checked automatically every day.
Reporting a problem
If you believe you have found a vulnerability, please tell us using the contact in our security.txt. For anything about your data, write to [email protected].