Skip to content
Authreads

Security

Your credentials, handled
like the one thing that can't go wrong.

What Authreads stores about a sign-in, for how long, and how to report a problem. The page linked as Secured by Authreads from every hosted login screen.

See what's stored
Long corridor with reinforced doors lit in cool blue, evoking a secured facility

Arrived here from a login screen?

If you followed “Secured by Authreads” from a sign-in page, you were trying to sign in to a specific company's product. Authreads is the identity infrastructure that product uses: we don't operate the product itself, and we can't see or change your account with it. Skip to where to get help with your account.
Close-up of a technician's hands verifying equipment at a secure workstation

Authreads processes your credentials on behalf of the product you signed in to

When a product uses Authreads for login, Authreads is the system that receives your password or one-time code at sign-in, verifies it, and issues the session your product then relies on. The product owns your account relationship (plan, billing, support), and Authreads owns the authentication step underneath it: hosted login built on OpenID Connect and OAuth 2.0. Depending on what the product's tenant allows, you can sign in with a WebAuthn passkey, an authenticator app (TOTP), or an emailed one-time code, and keep single-use recovery codes for when a device is lost.

Every tenant using Authreads is isolated at the data layer. Your credentials and session data are scoped to the one product you use, never visible to, or reachable from, any other tenant on the platform.

What's stored

What's stored, and how

Five categories of data touch a sign-in. Here is exactly what's kept for each, and what isn't.

Passwords

Never stored in a recoverable form. Only a one-way cryptographic digest is kept: Authreads cannot look up or recover your password, and neither can the product you use.

One-time codes, reset and invite links

Single-use and short-lived. A code or link is invalidated the moment it's used, or when it expires, whichever comes first.

Sessions

Recorded in a device and session inventory, with idle and absolute expiry. You, and a tenant administrator, can see active sessions and revoke any of them. Hardware-bound sessions remain planned; revocation takes effect on the next check, not on natural expiry.

Machine and agent credentials

Sender-constrained (DPoP, RFC 9449) and single-use where the flow calls for it, so a captured token isn't usable from anywhere but the holder that requested it.

Security and audit events

Sign-in, recovery, and session events are logged for security and abuse investigation, with access restricted to what's needed to operate the platform.

Retention windows are bounded and enforced by policy rather than left to run indefinitely; the one retention figure we publish outright, the contact form on this site, is on the privacy page. Compliance posture and data-handling detail beyond credentials live on Trust.

Reporting a security issue

If you believe you've found a genuine vulnerability in Authreads, not in a specific product built on top of it, but in the identity platform itself, email security@authreads.com with Security in the subject line. Include enough detail to reproduce the issue (affected URL or endpoint, steps, and impact), and avoid accessing or modifying data that isn't yours while you investigate.

Honest limit

We don't currently run a public bug bounty program or commit to a fixed response SLA. We do read and act on every genuine report; if it turns out to be a real issue, we'll tell you once it's resolved.
Two people talking across a desk in a bright office, one gesturing toward a screen

Where your account support actually lives

Authreads has no visibility into which company runs which product, no billing relationship with end users, and no support queue for individual accounts. That is structural, by design: the same isolation that keeps one tenant's data out of another's.

If you're locked out, can't receive a code, or have a question about your own account: contact the company whose product you were signing in to. Their support channel is the one that can see your account, your plan, and your history. Authreads cannot.

If you're a company evaluating or already running Authreads for your own product, use the contact form: that's the right path for platform-level questions.

Trust covers compliance posture, sub-processors, and incident process in more depth. FAQ answers the questions security reviewers ask most often during evaluation.

Evaluating Authreads for your own product?

We'll walk through the security model against your specific tenancy and threat model.