Privacy Policy

Auth247.net ('we', 'us', 'our') operates the authentication platform published at auth247.net (the 'Service'). We provide identity and access management: organisations ('Customers') use the Service to sign their users in and to manage those accounts, and the people who sign in to a Customer's application are 'End Users'.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, store and protect it, how long we keep it, and how you can access, export or delete it. It applies to auth247.net and all of its subdomains, our hosted sign-in pages, our APIs, our dashboards and any email we send. It does not apply to applications built by Customers that simply use the Service — those are covered by the Customer's own privacy policy.

If you are an End User signing in to a Customer's application, that Customer decides what data is collected about you and is the data controller for your account; we process it on their instructions. Requests about your account can be sent to that organisation, and we also accept them directly and will forward or action them as the law requires. This policy is published at https://auth247.net/privacy.

Information you give us

• Account and contact details — name, work email address, organisation name, job role, and the password you choose. Passwords are stored only as a salted adaptive hash (bcrypt) and never in plain text.
• Billing details — plan, billing contact, invoices and payment references. Payments are made by direct bank deposit and handled by our bank; we do not collect or store card numbers, and we never store your bank login credentials.
• Support and correspondence — the content of messages, tickets and attachments you send to us.
• Configuration data — the settings you create for your organisation, such as client applications, allowed redirect URLs, sign-in providers, branding, email templates, webhooks and security policies.

Information created when the Service is used

• Authentication events — sign-ups, sign-ins, failed attempts, password resets, magic links, email verifications, MFA enrolment and passkey registrations, each with a timestamp.
• End-user records held for Customers — typically an email address and/or phone number, display name, assigned roles, account status, and the sign-in methods linked to the account. We store only what the Customer chooses to send us.
• Device and technical data — IP address, browser and operating system, device type, user agent, the country or region derived from the IP address, and request metadata such as timestamps and error codes.
• Audit and security logs — administrative actions in the dashboard, API usage, rate-limit and threat-detection events, blocked IP records, and email delivery results (delivered, bounced, complained).
• Usage data — aggregate counts of monthly active users, sign-ins and emails sent, used for billing, capacity planning and reporting to the Customer about their own organisation.

Information we receive from external sign-in providers

• When a Customer enables an external sign-in provider (Google, Microsoft, Facebook, LinkedIn, GitHub, GitLab, Slack or Logto), the provider returns a limited profile so we can create or match the account: a provider-specific user identifier, email address, whether that email is verified, display name and profile picture.
• We request only the minimum scopes needed to sign the user in. We do not request, and cannot access, email contents, files, calendars, contacts, photos or any other service data.
• Where a Customer configures us to keep provider tokens (for example to call one of their own APIs later), those tokens are encrypted at rest and can be revoked by the Customer or the End User at any time.

Cookies and browser storage

• Strictly necessary only: a session cookie that keeps you signed in, a short-lived state/CSRF value that protects the sign-in and consent flow, and a local-storage entry that remembers whether you prefer the light or dark interface.
• No advertising cookies and no cross-site tracking. We do not run third-party advertising or profiling scripts inside the Service, and our own analytics are aggregate and de-identified.
• You can clear cookies and local storage at any time in your browser settings; the session cookie is required to stay signed in.

• Provide the Service — create and manage accounts, authenticate users, issue sessions, access tokens and OIDC ID tokens, apply the Customer's security policies, and deliver the emails a user asks for (verification, magic link, password reset, security alert, invitation).
• Keep the Service secure — detect and stop abuse, brute-force and credential-stuffing attacks, account takeover and fraud; enforce rate limits, lockouts and IP blocks; and maintain audit trails.
• Support Customers and End Users — answer questions, diagnose problems, and help with onboarding.
• Bill and account for usage — measure active users and email volume, issue invoices, and manage plans and limits.
• Improve the Service — understand aggregate, de-identified usage and reliability trends so we can fix and improve features.
• Communicate — send service, security and (where permitted) product-update emails, and respond to legal or regulatory obligations.

Where the GDPR or UK GDPR applies, we rely on these legal bases: performance of a contract (providing the Service to a Customer and authenticating its End Users); legitimate interests (securing the Service, preventing fraud and abuse, keeping records of authentication events, improving our product, and communicating with business contacts — always balanced against your rights); legal obligation (tax, accounting and responding to lawful requests); and consent where we specifically ask for it, such as optional product emails, which you can withdraw at any time.

What we access from Google

• Only the OpenID Connect scopes openid, email and profile: the Google account identifier (sub), email address, email-verified status, display name and profile picture.
• We do not request or access Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, Google Tasks or any other Google API, and we do not ask for offline access unless a Customer explicitly enables it.

Why we access it

Solely to sign the user in to the Customer application they are trying to reach: to confirm their identity, create or match their account, verify that their email address is verified, and display their name and avatar in the account interface. Nothing else.

How we handle and share it

• Encrypted in transit (TLS 1.3) and at rest (AES-256), with access restricted to the systems that complete the sign-in.
• Not used for advertising, not sold, not transferred to data brokers or advertising platforms, not used to determine creditworthiness or for lending, and not used to train or fine-tune general-purpose AI or machine-learning models.
• Shared only with the Customer whose application the user signed in to, and with our infrastructure sub-processors acting on our documented instructions. It is never transferred to other third parties for their own purposes.
• Retained only while the account it belongs to is active or as described in Section 7, then deleted.
• Read by a human only with the user's consent, where required to investigate a security incident or abuse, to comply with applicable law, or where the data has been aggregated and de-identified for internal operations.

How to remove it

A user can revoke our access at any time and stop all future access (see the links in Section 10). Revoking stops future access; to delete the profile data we already hold, send a deletion request as described in Section 10 and we will remove it promptly and in any case within 30 days, and confirm when it is done.

We do not sell personal data, and we do not share it for advertising. We disclose it only in the situations below.

Sub-processors

Vetted service providers that process data strictly on our documented instructions under written data-processing agreements: cloud hosting, database and storage infrastructure, transactional email delivery, DNS and domain services, payment and invoicing providers, and uptime/error monitoring. They may use the data only to provide their service to us, and a current list is available on request from privacy@auth247.net.

The Customer whose application you signed in to

End-user account records, authentication events and audit history belong to that Customer. Their administrators can view and export them from their dashboard.

Legal, safety and rights protection

Where we are required to by law, subpoena or court order, or where disclosure is necessary to protect the rights, safety and security of our users, our Customers or the public. We review every request for validity and scope, disclose only what is required, and notify the affected Customer where we are legally permitted to do so.

Business transfers

If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will notify affected Customers and this policy will continue to apply to the transferred data.

At your direction or with your consent

For example when a Customer configures a webhook or integration that sends authentication events to a system they control, or when you ask us to share data with a third party.

The Service runs on cloud infrastructure with regional data-residency options — Global, United States, European Union and Asia-Pacific — and each Customer chooses the region its organisation's data lives in. Where personal data is transferred out of the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest, access controls and data minimisation.

Customers can request our Data Processing Addendum, which includes the Standard Contractual Clauses, from legal@auth247.net.

Customer and account data

For as long as the account is active, then deleted within 90 days of account closure.

End-user account records

For as long as the Customer's application uses the Service and the End User keeps their account. Deleted within 30 days of a request from the End User, the Customer, or a verified deletion request to us.

Authentication, security and audit logs

12 months from the event, then deleted or de-identified. Records relating to an active security incident or legal claim may be kept longer where necessary to document and defend against it.

Email delivery logs

90 days.

Billing, tax and accounting records

For as long as tax and accounting law requires (typically 7 years). Kept separately from service data and access-restricted.

Encrypted backups

Retained on a rolling 35-day cycle, so deleted data ages out of backups within that period and is never restored except to recover from a failure.

Aggregate statistics

De-identified counts and metrics may be kept indefinitely. They cannot reasonably be linked back to an individual.

Deletion means the record is removed from live systems. Where we are legally unable to delete a record immediately, we isolate it, restrict access to it and delete it as soon as the obligation or hold ends.

• Encryption in transit (TLS 1.3) and at rest (AES-256), with field-level encryption for sensitive values such as provider client secrets and stored provider tokens.
• Passwords are stored only as salted adaptive hashes (bcrypt). Passkey private keys never leave the user's device — we store only the public key. One-time codes and magic links are single-use and short-lived.
• Authorization codes are single-use, expire in 10 minutes and support PKCE; refresh tokens can be rotated and revoked; sessions expire and can be ended by the user or an administrator.
• Least-privilege internal access, mandatory multi-factor authentication for staff, key management with rotation, and complete administrative audit logging.
• Continuous monitoring with automated anomaly and threat detection, IP blocking, rate limiting, brute-force lockouts and CAPTCHA escalation.
• A security programme aligned to SOC 2 Type II: peer code review, change management, dependency scanning, regular penetration testing, documented incident response and business-continuity planning.
• Breach notification: if a breach affects personal data, we notify affected Customers without undue delay and, where the law requires it, the relevant supervisory authority within 72 hours of becoming aware of it.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete data corrected.
• Deletion — have your personal data erased (see Section 10).
• Restriction and objection — limit or object to certain processing, including processing based on legitimate interests.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider.
• Withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of processing already carried out.
• Non-discrimination — we will not degrade the Service or charge you more because you exercised a privacy right.

California residents (CCPA/CPRA): you may know what categories of personal information we collect, the sources, the purposes, and the categories of recipients; request access, deletion or correction; and opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising. An authorised agent may make a request on your behalf.

To exercise any right, email privacy@auth247.net from the address on the account, or tell us the account the request relates to. We verify requests so that we never hand data to the wrong person, respond within 30 days, and will tell you if the law allows us more time. Where we process data purely as a processor for a Customer, we forward the request to that Customer and support them in answering it. If you are not satisfied with our response, you may complain to your local data-protection authority.

You are in control of your data and can have it deleted in any of the following ways.

1. End Users of a Customer's application — use the delete-account option in that application if it offers one, or ask the organisation that owns the application: its administrators can delete your record from their dashboard at any time. Alternatively request deletion from us directly using step 3.
2. Customers — delete individual end users, client applications, webhooks and API keys yourself from the dashboard at any time, or close the whole organisation from App Settings → Danger zone. Closing the account begins the deletion process in Section 7 and removes live data within 90 days.
3. Ask us directly — email privacy@auth247.net with the subject 'Data deletion request', from the address on the account (or from any address if you are an End User), telling us which application you signed in to. We verify the request, delete the data, confirm the completion in writing, and complete the request within 30 days.
4. Revoke a connected sign-in provider — revoking stops all future access immediately. To also delete the profile data we already hold, send the request in step 3.
5. Want a copy first? Ask for an export before deleting — deletion is permanent and cannot be undone.

• Google — revoke access (myaccount.google.com/permissions)
• Microsoft — manage app consent (account.live.com/consent/Manage)
• LinkedIn — manage third-party applications
• Facebook — apps and websites

Data we must keep for legal reasons — for example invoices for tax purposes — is isolated from service data, access-restricted, and deleted as soon as the retention period ends.

The Service is a business tool and is not directed to children. Customers must not use it to authenticate children under 13, or under 16 where local law sets that age, unless they hold the consent the law requires — as the controller, that is their responsibility. If you believe a child's data has been provided to us without the required consent, email privacy@auth247.net and we will delete it.

We may update this policy as the Service or the law changes. The 'Last updated' date at the top of this page always shows the current version, and each version applies from the date shown. For material changes we notify Customers by email and in the dashboard before the change takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.

We are Auth247.net, 535 Mission Street, San Francisco, CA 94105, USA.

• Privacy questions, exports and deletion requests — privacy@auth247.net
• Security reports and vulnerability disclosure — security@auth247.net
• Contracts, DPA and legal notices — legal@auth247.net

We acknowledge every privacy request within 5 business days and answer in full within 30 days.