Pending legal approval
Security
How OneID protects accounts and data, and how to report a vulnerability.
This document is being drafted with counsel
It is not published yet, and nothing on this page is a legal agreement or a statement of your rights. We are not generating this text — it is the document people rely on when something goes wrong, and it needs to be written by somebody qualified to write it.
What it will cover
- 1Reporting a vulnerability, and what to expect
- 2Scope: what is in and out of testing scope
- 3Account security: authentication, sessions and revocation
- 4Encryption in transit and at rest
- 5Tenant isolation between organizations
- 6How staff access to customer data is controlled and recorded
- 7Credential handling: what is hashed, what is never stored
- 8Logging, and what is deliberately kept out of logs
- 9Backups and recovery
- 10Incident response and notification
- 11Subprocessors
- 12Current certification status
In the meantime
OneID is in development and is not offered as a commercial service. If you have a question about what we hold or what we do with it, ask and we will answer directly rather than pointing at a document that is not finished.