Passwords are one-way hashed using a memory-hard password hashing algorithm.
Trust / Security
Controls that belong to the application.
Abnio treats edge services as optional layers—not the foundation. Authentication, authorization, tenant isolation and collection correctness are enforced by Abnio itself.
Account & access protection
Every customer account is protected by app-native two-factor authentication, and access is resolved against the requested site on every analytics route.
Authenticator-app codes are enforced before customer site data loads, with single-use recovery codes.
Browser sessions remain server-controlled and state-changing requests use CSRF protection.
Analytics routes resolve site grants explicitly; admin and viewer permissions remain distinct.
Internal access can be limited by both role and an explicit site allow-list.
Administrative mutations create audit records for later review and incident investigation.
Collection & data safeguards
Security includes reducing what can be exposed. Abnio avoids raw IP storage and durable cross-site browser identity, while protecting the credentials required to operate integrations.
Public application and collection surfaces are served over HTTPS.
IP addresses are transformed transiently into scoped hashes and are not stored as raw values.
Google OAuth refresh tokens and TOTP secrets are encrypted at rest.
Overlapping active tokens allow planned rotation without data loss; the last active token cannot be revoked.
Install verification restricts destinations, revalidates redirects and addresses, and caps time and body size.
Public collection returns minimal bodyless responses and avoids leaking tenant detail through errors.
Responsible disclosure
Found something? Tell us carefully.
Please report suspected vulnerabilities privately with the affected surface, reproduction steps and potential impact. Do not access another customer’s data, degrade the service, use social engineering or publish details before we have had a reasonable opportunity to investigate.
