Security
Security decided on the server, every time
Every request is checked by our API: who you are, what you own and what you are allowed to do. This is how we protect your account, your licence and the software you download.
How we protect you
Defence in every layer
Server-side authorisation
The API decides every session, licence, activation and download. Hiding a button in the browser is never how anything is protected.
Strong password storage
Passwords are hashed with Argon2id. We require at least 15 characters and refuse common choices and passwords that contain your email address.
Protected sessions
Session cookies are HttpOnly, so page scripts cannot read them. Sessions end after inactivity and after a fixed maximum, and you can end them yourself.
Cross-site protection
Requests that change anything are refused unless they come from this website, even with a valid session.
Short-lived desktop tokens
The desktop app works with access tokens that expire after 15 minutes and refresh tokens that rotate on every use.
Two-factor staff access
Staff need an authenticator code to sign in, and a fresh one before high-risk actions. Staff sessions also time out sooner.
Private, verified downloads
Installers are served only through signed links that expire after 5 minutes, with SHA-256 checksums calculated on our servers.
Append-only audit trail
Sensitive actions are recorded in an audit log the database will not let anyone edit or delete. Our logs are scrubbed of passwords, keys and tokens.
Strict browser policies
Every page sends a Content Security Policy with a fresh nonce, and other websites cannot frame this one.
Current limits at a glance
- Password hashing
- Argon2id
- Minimum password length
- 15 characters
- Customer sessions
- End after 60 minutes idle, 12 hours at most
- Staff sessions
- End after 15 minutes idle, 8 hours at most
- Desktop access token
- 15 minutes
- Download link
- 5 minutes
- Activation code
- 10 minutes
- Email confirmation link
- 24 hours, single use
- Password reset link
- 30 minutes, single use
- Installer integrity
- SHA-256 checksum for every version
What we will never ask for
- Your password
- Your Activation Key
- One-time activation codes or authenticator codes
- Password reset or email confirmation links