Security & Data — Abrova Auth

What Abrova Auth stores about your users, how it is encrypted, how passwords, tokens and codes are protected, the limits against brute force and bots, the activity log, and how account deletion works.

Security & data.

Abrova Auth keeps as little about your users as it can, encrypts what it must keep, and stores secrets (passwords, tokens, codes) only in a form that cannot be turned back into the secret.

What is stored#

Data	When	How
User id, created, last active	Always	Plain (the id is random)
Linked methods	Always	Which methods, plus a keyed hash of the Apple or Google account id
E-mail address	E-mail + password and magic link (it is the login)	Encrypted, plus a keyed hash to find the account
E-mail and name from Apple or Google	Only when Store profile data is on (off by default)	Encrypted
Phone number	Telegram sign-in (it is the login)	Encrypted, plus a keyed hash to find the account
Password	E-mail + password	One-way hash only
Refresh tokens, e-mail link tokens, codes, nonces	While valid	Hash only

Turn Store profile data on under Abrova Auth › Settings only if your app needs the e-mail or name Apple and Google return. With it off, those users are known only by their id and the hash of their provider account id.

Encryption#

At rest: personal data (e-mail addresses, names and phone numbers) is encrypted at rest.
In transit: every request uses HTTPS.
Passwords: stored as one-way hashes, never stored or logged in any readable form. Sign-in takes the same time whether or not the e-mail has an account.
Your project's secrets (the Telegram bot token and the Apple key for account deletion) are stored encrypted and never shown again after you save them.
Logs never contain tokens, passwords, e-mail addresses, phone numbers or IP addresses in clear.

Isolation between projects#

The project of every request comes from its API key, never from what the app sends in the request. Users, sessions and settings of one project cannot be read or used from another. An access token names its project, and every Abrova product refuses a token of another project.

Protection against attacks#

Threat	Protection
Password guessing	Limits per address and per e-mail; the same answer (INVALID_CREDENTIALS) for an unknown e-mail and a wrong password.
Finding out who has an account	Password reset and magic link always answer the same, whether the address has an account or not.
Bots creating users	Per-address limits and a daily cap on new anonymous users per project.
A stolen refresh token	Rotation on every renewal; using an old one again ends the session.
A stolen access token	Lives one hour. Never logged.
A captured Apple or Google ID token	Each nonce works once; ID tokens older than 10 minutes are refused.
An ID token issued to another app	Accepted only for the bundle IDs, Services IDs and client IDs you entered for this project.
Guessing a code or link	6-digit codes allow 5 attempts in 5 minutes; e-mail links are long random values that work once.
E-mail links sent elsewhere	Links only open the link addresses you allowed.

Over a limit, the call fails with RATE_LIMITED and says when to try again (retryAfterSec).

Activity log#

Included for every project: Abrova Auth › Activity shows your project's security events: users created, sign-ins and failed sign-ins, linked methods, password resets, sign-out everywhere, reused refresh tokens, users disabled, enabled or deleted, and settings changes. Events show a hashed source address, so you can tell that two events came from the same place without seeing the address.

Account deletion#

Apple requires apps that offer account creation to let users delete their account in the app. Call deleteAccount():

The user, all of their sessions and linked methods, and everything Abrova Auth stores about them are deleted. This cannot be undone.
If the user signed in with Apple and you set up the account deletion key (Team ID, Key ID and the .p8 private key under Abrova Auth › Sign-in methods › Apple), Abrova Auth also revokes the user's Sign in with Apple for your app, as Apple asks. Pass Apple's authorizationCode when the user signs in with Apple, or this step has nothing to revoke.
Data in other Abrova products (Sync documents, Chat messages, files in Storage) is not deleted. Delete it from your app before you call deleteAccount(), while the user's token still works.

You can also delete a user from Abrova Auth › Users in the Console.