Security.
Products on Dianthan hand us their customers' identities, payments and data. This page describes how we protect them, what we commit to, and what we don't claim yet.
Accounts and access.
Identity is the system that other systems trust, so it is the most conservative one.
No passwords to leak
People sign in with single-use emailed links or with an OAuth provider. There is no password database to steal.
Short-lived sessions
Access tokens expire within minutes. Refresh tokens rotate on every use and are stored only as hashes, so a copied database row cannot be replayed.
Second factors and step-up
Authenticator codes with recovery codes, and a fresh check before sensitive actions such as changing keys or deleting data.
Scoped, expiring keys
API keys belong to one product, carry only the permissions they were given, can expire, and are stored as hashes. Revocation takes effect on the next request.
Isolation.
Many products share the platform. None of them can reach each other.
Enforced in the data layer
Every record carries the product it belongs to and every query is filtered by it, rather than relying on each route to remember.
Tested on every release
A dedicated suite attempts cross-product access through every route. A release that fails it does not ship.
Limits per product and per visitor
Request quotas per product, and stricter limits on sign-in endpoints per visitor, so one product's traffic or abuse cannot affect another.
Records and data.
What happened is written down, and the data is yours.
Append-only audit log
Every change made by a person, a server or an agent is recorded with the credential that made it. Entries cannot be edited or deleted, including by us.
Encryption
TLS on every connection. Data and backups are encrypted at rest.
Signed webhooks
Incoming payment events are verified before they're applied, exactly once. Outgoing webhooks are signed so your systems can verify them.
Export and deletion
Export a product's data at any time. When you close an account, its data is deleted and its backups expire on their normal schedule.
Commitments.
Plain statements of where we are, including what is still in progress.
Data processing agreement
A standard agreement for customers who process personal data on Dianthan, with the list of sub-processors we rely on. Ask and we'll send it.
Certifications
We don't hold a SOC 2 or ISO 27001 certification yet. The infrastructure we run on does, and we will publish our own reports here when we have them.
Incidents
Customers affected by a security incident are told directly and promptly, followed by a written report of what happened and what changed.
Report a vulnerability.
Write to security@dianthan.com with the steps to reproduce. We reply within two working days, keep you informed until it is fixed, and credit you if you'd like. Please test only against accounts you own and don't access other customers' data.