Skip to content
AUTH.00

Trust

We would rather be checkable
than reassuring.

This page starts with what we do not have, because that is the part you would otherwise have to dig for. Then it says what we do instead — and where that is genuinely not a substitute.

What we hold Report a vulnerability

Compliance

What we meet, and what we help you meet.

Two columns, and one of them is empty. An empty column with a date next to it is credible. A filled one without an audit report makes everything else on this page worthless.

We meet

Nothing yet. auth00 holds no ISO 27001, no SOC 2 and no FedRAMP authorisation today. Not "in progress" as a figure of speech — simply not held.

ISO 27001 is the one we intend to pursue first, because it is the one most procurement processes actually ask for. No date is published here, because a date without a booked audit is a wish.

We help meet

Where we do add weight is in your evidence: ISO 9001, 14001, 27001 and 42001 all require records that are complete, attributable and unaltered since.

That is exactly what a seal produces. A sealed document has a fixed content, a fixed point in time and a named sender — the three properties an auditor asks about and the three a shared folder cannot give.

GDPR

We process in Europe and name every processor. The data subject rights — access, portability, erasure, restriction, objection and the rules on transfers — are handled in our privacy policy, the data processing addendum and the sub-processor list.

An ISO 27001 certificate would map onto much of this. We do not have one, so the documents have to carry it on their own.

If a certificate is a hard requirement in your procurement, buy the large vendor. We would rather say that on this page than in month three of an integration.

Instead of a certificate

Evidence that is recomputed, not filed.

A certificate says an auditor looked once. These four say something is being measured now — which is a different claim, weaker in some ways and stronger in others.

  • Guards with a calibration corpus. Every guard we run has to fire on a deliberately broken case and stay silent on a correct one, and that calibration runs before the guard does. A guard nobody calibrated only proves that nothing tripped it.
  • Three outcomes, never two. Clean, finding, and not measurable — each with its own exit code. A measurement that fails must never look like quiet.
  • Measured against the delivered byte. Not against the working tree and not against the commit: against what the address actually returns. A clean checkout says nothing about what a service is running.
  • A transparency log that can be recomputed. Agent certificates are issued from a measurement and can be withdrawn. You check them against the log rather than against us.

Where this is not a substitute: an auditor also checks the things a machine cannot — staff processes, supplier management, how an incident is actually handled. We measure the technical claims. We do not measure ourselves into an organisational certification, and we will not pretend otherwise.

Security

How the door is built.

Properties of the identity platform, each one checkable from outside
PropertyHow it works
No passwords to steal Magic link and a six-digit code, both valid five minutes. Passkeys and TOTP for a second factor. There is no password database to breach because there is no password.
Proof key for code exchange PKCE with S256 only — the plain method is not offered. Pushed authorization requests keep parameters off the address bar entirely.
Tokens bound to a key DPoP binds a token to the key that requested it (cnf.jkt). A stolen bearer token alone does not open anything.
Reuse is treated as theft Refresh and agent keys rotate. Presenting a rotated key revokes the whole family rather than the single key, so a leak ends instead of persisting.
The file never reaches us Sealing and verifying hash in the browser. Sixty-four characters travel. There is no asset store to compromise because the asset is never uploaded.
Audit trail you can verify The console exposes its audit log with a verification endpoint, so the record can be checked rather than believed.

Report a vulnerability

If you found something, we want it.

There is no bug bounty. There is no prize money and we will not pretend otherwise — a programme we cannot staff would waste your time more than ours. What there is: a documented route, a stated response time, and a promise not to come after you.

  • The route. https://auth00.co/.well-known/security.txt, machine readable per RFC 9116, pointing at our contact page. No address is printed in the open, so it cannot be scraped.
  • What we promise. An acknowledgement within three working days and an assessment within ten. If a report is a duplicate or out of scope, you get told that — not silence.
  • Safe harbour. Report in good faith, do not exfiltrate data belonging to other people, do not degrade the service, and give us time before publishing. Under those terms we will not pursue you, and we will credit you if you want it.
  • In scope. auth00.co, login.auth00.co and the endpoints listed in our OpenAPI document. Out of scope: findings from automated scanners without a working proof, and anything requiring physical access.

Severity is rated with the Bugcrowd Vulnerability Rating Taxonomy so that a P-level means the same to you as it does to us. It is open, maps onto CVSS, and it is not ours — which is precisely why it is a fair yardstick.

See the live state, not the claim

Every property on this page is meant to be checkable from outside. The status page shows what is being measured right now, including when the measurement itself is failing.

Open the status page Ask us something specific