Security
How Avonao ID protects sign-in, sessions and your data, and how to report a vulnerability.
What we protect#
Avonao ID is the account behind your sign-ins to Avonao platforms and to apps that offer "Sign in with Avonao ID". Three things have to stay true: nobody else can get into your account, an app only receives what you allowed, and your personal data stays in the region you chose.
| Area | What we do |
|---|---|
| Sign-in | Passkeys (user verification required), email link or code, and social sign-in with Google, Microsoft or GitHub. No passwords are stored, because there are none. Email links and codes are single-use, expire after 10 minutes and allow at most 5 code attempts. |
| Second step | Optional two-step sign-in with an authenticator app (TOTP) with replay protection, and single-use recovery codes that are stored only as hashes and shown once. Apps can ask for a stronger sign-in before a sensitive action (step-up). |
| Guard name and emergency kit | A sign-in link is sent only when the email address and your Guard name are both right, so a hacked mailbox alone is not enough. The emergency kit carries your recovery key. |
Avonao ID
