Skip to content
SECURITY

Security is the product.

The practices we hold ourselves to — across data, operations, and the application itself.

Security practices

Data protection

EU-only data residency (your EU region)
TLS 1.2+ in transit, AES-256 at rest
Per-environment secret isolation
Breach-password & credential-stuffing defense
No third-party CDN, analytics or fonts — first-party only

Operations

Least-privilege, role-based access
End-to-end audit logging (hash-chained, externally anchored)
Every outbound call inventoried with a jurisdiction verdict
AGPL / secrets / zero-leak CI gates on every change
Self-hosted proof-of-work CAPTCHA — no third-party bot service

Application

Phishing-resistant passkeys (WebAuthn)
Rate limiting & bot defense by default
Short-lived sessions with refresh rotation
Tenant-bound, audience-scoped access tokens
Algorithm-agile token signing (per-key alg, rotation built in)
Code review on every change
CRYPTOGRAPHIC AGILITY

Ready for what comes next in cryptography.

Today we sign tokens with ES256, behind an algorithm-agile signing layer with key rotation built in — adding a new signature scheme is a configuration change, not a rewrite. We follow NIST's post-quantum standards (ML-DSA, ML-KEM) and will adopt hybrid signatures once the JOSE and OIDC ecosystems standardise them. What we won't do is put experimental cryptography in the path your users authenticate through. And where post-quantum protection matters most today — defending data in transit against “harvest now, decrypt later” — our roadmap targets hybrid key exchange at the network edge.

RESPONSIBLE DISCLOSURE

In scope

Our production apps and APIs under adetio.eu. Test against your own account only — never another customer's data.

Safe harbour

Act in good faith, avoid privacy violations and service disruption, and we won't pursue legal action for your research.

How to report

Email security@adetio.eu with steps to reproduce. We acknowledge within two business days and keep you posted through to a fix.

Found a vulnerability?

We read every report and act on it. Acknowledged within two business days, with updates through to a fix.

Report an issue →