Key management

In plain language: the sign-in service holds the keys that sign ID tokens, encrypted. No route hands them out, and only their public halves are published.

2. Key ids

A key id (kid) is derived from the public key itself: the first 22 characters of the base64url SHA-256 hash of the key's crv, kty, x and y members as JSON. You can recompute it from the published key, so nobody can attach a different id to a key without it showing. Every ID token names its key in its header.

3. Where the public keys are published

4. Pinning a key

For the strongest position, fetch the key set once, store each kid with its x and y values in your own repository, and verify against that copy. Refresh it when a new kid appears.

5. Rotation

Rotation runs by itself: the active key is replaced once it is 90 days old and its successor has been published for 24 hours. A new key is published in the key set at least 24 hours before it first signs, so verifiers have it cached in time. A retired key stays published long enough for tokens signed just before the change to verify.

6. If a key is compromised

A compromised key can be revoked and removed from the published set at once, which makes tokens it signed stop verifying. We handle a suspected compromise as a security incident: exposed secrets are rotated, the sessions of affected accounts are ended and an affected route can be switched off. Affected people are told by email.

Report a suspected compromise to security@avonao.com.

7. What custody does not protect against

Access to production is limited to named Avonao staff bound by confidentiality, and administrative functions need a separate token that is held as a platform secret, not in the database. Even so, the keys are not in a hardware security module, and whoever holds both the database and the key-encryption key could cause tokens to be signed. There is no key transparency log and no external audit of key handling today. Moving signing to a cloud key management service is designed, not built.

8. Contact

Questions: security@avonao.com.

EU notices

• Reporting a business: notice and action
• Ranking rules of Avonao Business Circle
• Digital Services Act
• EU Data Act

Corporate transparency

• Imprint
• Impressum
• Modern Slavery and Human Trafficking Statement

Program terms

• Startup Program Terms