Trust

Security

Last updated: 13 June 2026

Security is designed in from the authentication layer outward. Here is how we protect your account and data.

Passwordless by default

Authentication uses WebAuthn passkeys — phishing-resistant credentials bound to your device. There are no passwords to leak, phish, or reuse. You can register multiple passkeys (phone, laptop, hardware key).

Secrets are hashed, never stored in cleartext

• API keys and refresh tokens are stored as SHA-256 hashes. A compromised database reveals no usable credentials.
• The full API key is returned once at creation; it cannot be recovered.
• The JWT signing secret is held as an encrypted Workers secret, never in code or logs.

Transport & headers

• HTTPS-only with Strict-Transport-Security.
• A strict Content-Security-Policy and X-Content-Type-Options on all responses.
• No cookies are used for API authentication; CSRF is not applicable.

Data minimisation

Logs contain user IDs only — no emails, request bodies, or results. Anonymous usage is tracked by a non-reversible fingerprint.

Responsible disclosure

Found a vulnerability? Please report it responsibly rather than exploiting it. We will investigate and fix credible reports promptly.