You are trusting us with sign-in. This is how AuthFI is secured.

Your data stays where you put it

A project lives in one region for life.

• Accounts, sessions, keys and the record are kept in the region you chose
• The part of AuthFI that runs worldwide holds accounts, plans and billing only
• On Enterprise, the region can be your own cloud account or data centre

Each customer is isolated by the database

Not by a filter in application code.

• Row-level security on the tables that hold customer data
• The application connects with a role that cannot bypass it
• Each project has its own address, its own issuer and its own keys

Keys and secrets

Nothing sensitive is stored in the clear.

• Signing keys per project, rotated without signing anyone out
• Secrets are sealed before they are stored, bound to the customer they belong to
• A secret is shown once, when it is created, and never again

Credentials that expire

A stolen credential is useful for minutes.

• Agent tokens last 15 minutes; a token for one action lasts 60 seconds
• Server certificates last five minutes
• A sign-in assertion is accepted once, and never again

When in doubt, it refuses

A failure must not become a yes.

• If a customer's plan cannot be read and no copy from the last five minutes is held, the request is refused
• If a revocation cannot be checked, the token is treated as revoked
• An approval nobody answers lapses and is refused

A record that shows tampering

For your actions, and for refusals.

• Every sign-in, grant, approval and refusal is recorded
• Entries are chained, so an edit or a gap is visible
• The record can be sent to the log tools you use

How we change the product

No change reaches a service unreviewed by a machine, and the sensitive ones by a person.

• Every change goes through a pull request with passing checks
• Changes to keys, sign-in, authorization and the edge need a person's approval
• Dependency vulnerability alerts are on for every service repository

Sign-in to AuthFI itself

The same controls we sell.

• Passkeys and a second step for the people who run your project
• Repeated failed sign-ins from one IP address lock the account out from that address, and passwords found in known breaches are refused
• Calls from a region to the global plane carry a client certificate, and calls from the global plane to a region carry a signed assertion