Identity and sessions
First-party authentication uses password hashing, email verification, short access tokens, rotating refresh credentials stored as hashes, SameSite cookies, and CSRF proof for cookie-authenticated mutations.
SECURITY AT INDOO
Protect the brand, the tenant boundary, and every consequential action.
Review Indoo security practices for TLS, headers, identity, sessions, CSRF, rate limits, tenant scope, provider secrets, audit events, deployment, and disclosure.
PUBLIC STANDARDIdentity and sessions
First-party authentication uses password hashing, email verification, short access tokens, rotating refresh credentials stored as hashes, SameSite cookies, and CSRF proof for cookie-authenticated mutations.
Dated Reviewable Limits shown
DIRECT ANSWER
Indoo's implemented security layers include HTTPS and HSTS at the edge, a content security policy and defensive headers, Argon2id password hashing, short-lived signed access tokens, rotating server-tracked refresh sessions, secure cookie controls, CSRF checks, rate limits, tenant-scoped data access, encrypted provider-secret storage, and audit events.
Verified against the current Indoo product · 2026-08-17PUBLIC RECORD
Claims should be specific enough to verify.
For security, the current public standard is shown below.
Tenant and action boundaries
Repository operations apply tenant and brand scope; material writes use authorization, audit context, and idempotency where required.
Edge and operations
The deployment uses TLS, HSTS, compression, restrictive headers, private application networking, health checks, bounded logs, immutable releases, and production configuration validation.
HOW WE APPLY IT
Move from a stated standard to an accountable action.
For security, the sequence keeps context, ownership, and the next decision visible.
- 01
Report privately
Email [email protected] or [email protected] with a concise description, impact, and safe reproduction steps.
- 02
Avoid harm
Do not access other people's data, degrade service, use social engineering, or publicly disclose an unresolved issue.
- 03
Coordinate remediation
Indoo will validate, prioritize, communicate, and request a safe retest when appropriate.
TRANSPARENCY NOTE
No SOC 2, ISO 27001, HIPAA, PCI, uptime, data-residency, or other certification claim is made on this page. Request current deployment-specific assurance information.
DECISION QUESTIONS
What people ask before choosing this path.
Answers stay specific to security and the current product boundary.
Are sessions stored only in browser local storage?
No. The production design uses short-lived access tokens and rotating server-tracked refresh sessions, with the refresh credential carried in an HttpOnly secure cookie.
How are cross-brand leaks prevented?
Tenant and brand scope are enforced in repository access and integration tokens rather than delegated to an AI model.
Where can I report a vulnerability?
Use [email protected] or the instructions at /.well-known/security.txt.
PUT SECURITY TO WORK
Apply this page to your real brand and next marketing goal.
- No payment card in signup
- Website-first brand setup
- Human approval available