Source Sign in Add your site

Trust centre

Trust and security

What signo stores, where this copy runs, which standards it follows, and how to report a problem. The code is open, so you can check all of it.

Passwords

None stored

passkeys and email links only

Stores

Email, name, passkeys

plus sessions and the sites you allow

Code

Open source

AGPL-3.0, on Codeberg

Status

Status page

coming soon

Standards

OpenID Connect, on an OpenID Certified coreLIVE
Authorization code with PKCE (S256), required RFC 7636LIVE
Passkeys WebAuthnLIVE
Tokens for one service only RFC 8707SOON
Tokens bound to the app's own key, for single-page apps RFC 9449 DPoPLIVE
Tokens bound to the agent's key RFC 9449 DPoPSOON
Device sign-in for agents RFC 8628SOON
Limits inside the request RFC 9396SOON
OpenID conformance results for usesigno.co.uk, publishedSOON

Where this copy runs

  • Hosting and database: alwaysdata, Paris, France
  • Sign-in emails: sent through alwaysdata's mail server
  • Access log: kept by alwaysdata; each line holds only the time, method, status and duration of a request
  • Backups: alwaysdata's automatic backups, which its Plus plans keep for 7 to 30 days. A deleted account can stay in a backup until that backup expires.

Pages load nothing from other sites: no analytics, advertising or tracking.

How long things are kept

Sign-in links15 minutes
Authorization codes1 minute
Access tokens10 minutes
Sessions14 days
Single-page app refresh tokensup to 14 days
Permission given to a siteup to 1 year
Account, name, passkeysuntil deleted

Practices

  • No passwords, ever: passkeys and email links only
  • Accounts exist only after their email link is used, so every email is verified
  • signo writes no request logs
  • Rate limits per email address and per IP, held in memory for 15 minutes
  • No third-party scripts: the content security policy allows only signo's own
  • Other sites can't frame signo's pages, which blocks clickjacking
  • Signing-key rotation and off-site backups SOON
  • Every change tested in CI before release SOON

Report a problem

This copy has no security contact address yet. If you found a security problem in signo's code, open an issue on Codeberg that says only that you found one, without details, and we will arrange a private way to send them.

Documents

Terms of serviceSOON
Data processing agreementSOON