# Trust and security

> What signo stores, where this copy runs, which standards it follows, and how to report a problem. The code is open, so all of it can be checked: https://codeberg.org/egglabs/signo

## Standards

| Standard | Status |
|---|---|
| OpenID Connect, on an OpenID Certified core | live |
| Authorization code with PKCE (S256), required (RFC 7636) | live |
| Passkeys (WebAuthn) | live |
| Tokens for one service only (RFC 8707) | planned |
| Tokens bound to the app's own key, for single-page apps (RFC 9449 DPoP) | live |
| Tokens bound to the agent's key (RFC 9449 DPoP) | planned |
| Device sign-in for agents (RFC 8628) | planned |
| Limits inside the request (RFC 9396) | planned |
| OpenID conformance results for usesigno.co.uk, published | planned |

## What signo stores

Email, an optional name, the public half of each passkey, timestamps, sessions, and the sites each person allowed. No passwords. Details: https://usesigno.co.uk/docs/security.md

## Where this copy runs

- **Hosting and database:** alwaysdata, Paris, France
- **Sign-in emails:** sent through alwaysdata's mail server
- **Access log:** kept by alwaysdata; each line holds only the time, method, status and duration of a request
- **Backups:** alwaysdata's automatic backups, which its Plus plans keep for 7 to 30 days. A deleted account can stay in a backup until that backup expires.

Pages load nothing from other sites: no analytics, advertising or tracking.

## How long things are kept

| What | How long |
|---|---|
| Sign-in links | 15 minutes |
| Authorization codes | 1 minute |
| Access tokens | 10 minutes |
| Sessions | 14 days |
| Single-page app refresh tokens | up to 14 days |
| Permission given to a site | up to 1 year |
| Account, name, passkeys | until deleted |

## Practices

- No passwords, ever: passkeys and email links only
- Accounts exist only after their email link is used, so every email is verified
- signo writes no request logs
- Rate limits per email address and per IP, held in memory for 15 minutes
- No third-party scripts: the content security policy allows only signo's own
- Other sites can't frame signo's pages, which blocks clickjacking
- Signing-key rotation and off-site backups (planned)
- Every change tested in CI before release (planned)

## Report a problem

This copy has no security contact address yet. If you found a security problem in signo's code, open an issue at https://codeberg.org/egglabs/signo/issues that says only that you found one, without details, and we will arrange a private way to send them.

## Documents

- Privacy notice: https://usesigno.co.uk/privacy
- Security model: https://usesigno.co.uk/docs/security
- Terms of service: planned
- Data processing agreement: planned
- Source code: https://codeberg.org/egglabs/signo