Buyer questions
Security questions to ask an identity provider (and what good answers look like)
The questions a security reviewer should ask any identity vendor about isolation, sessions, tokens, keys, incidents and certifications — with what to look for.
The short answer
When evaluating an identity provider, ask where tenant isolation is enforced and what happens if a developer forgets a filter; how sessions and refresh tokens are revoked and how fast; how signing keys are protected and rotated; which standards are supported versus proprietary; what certifications are actually held today; and how incidents are disclosed. Good answers are specific and checkable; vague ones are a finding.
Sources last reviewed .
The questions
- Isolation: enforced in the database or in application code? What test proves it?
- Sessions: idle and absolute limits, per-tenant configuration, revocation latency.
- Tokens: lifetimes, refresh rotation, sender-constraining, revocation endpoint.
- Keys: algorithm, storage, rotation schedule, published JWKS.
- Standards: which OIDC and OAuth features are supported, and which are planned rather than shipped.
- Credentials: password hashing algorithm, breached-password checks, MFA options.
- Certifications: which are held today, with report dates — not 'in progress'.
- Incidents: notification commitment, status page, vulnerability disclosure contact.
- Exit: data export format, password hash export, migration support.
In Authreads
How this applies to Authreads
Our own answers are on /security, /trust and /roadmap, including what we do not have: no SOC 2 or other third-party certification is held today.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.