Security
How AkraID protects your access data
AkraID can see who has access to every app you run through Okta. Here's exactly what it holds, how it's protected, and what we don't have yet.
Connecting to Okta
- No API tokens. AkraID generates its own RSA key pair. You add the public key to an Okta API Services app, and AkraID proves who it is by signing requests with the private key, which never leaves AkraID. There's no shared secret that could leak from a ticket, a chat message or a password manager.
- Tokens bound to the key. AkraID uses DPoP, so the short-lived access tokens Okta issues are useless to anyone who doesn't also hold AkraID's private key.
- Read-only by default. AkraID asks Okta only for permission to read users, apps and the sign-in log. It can remove app assignments only if you grant okta.apps.manage and turn on automatic removals.
- Removals are checked. After removing access, AkraID reads it back from Okta and records the result. If the access is still there, the removal is marked as failed, not done.
- Its own app is never touched. AkraID skips the Okta app it uses to connect, so a review can't lock it out by accident.
Signing in
- People sign in to AkraID through your Okta (OpenID Connect with PKCE). AkraID never sees or stores a password, and your Okta MFA and session policies apply.
- The sign-in connection also uses a key pair instead of a client secret.
- Three roles: admins set things up, reviewers make decisions, auditors can look at everything and change nothing.
- Nobody can approve their own access. Their grants go to a backup reviewer.
- Sessions are stored only as hashes, so a copy of the database can't be used to sign in.
What we store
| We store | We don't store |
|---|---|
| Names, work emails, logins, titles, departments and managers from Okta | Passwords, MFA factors or recovery codes |
| Account status (active, suspended, deactivated) | The content of any app: no files, messages or records |
| Which apps each person can use, and their role in each | Okta API tokens (there aren't any) |
| When each person last signed in to each app, from Okta's sign-in log | Payment card numbers |
| Review decisions, reasons, notes and removal records |
We use this data only to run your reviews. We don't sell it, share it for advertising, or use it to train AI models. See the privacy policy for details.
Encryption
- In transit: HTTPS everywhere, with HSTS so browsers refuse to connect without it.
- At rest: the database runs on encrypted storage. On top of that, AkraID encrypts the private keys it uses for Okta with AES-256-GCM, and each encrypted key is bound to its own record so it can't be copied to another one and still decrypt.
- The encryption key lives in the hosting environment's secret settings, never in the code or the database.
The audit trail
Every action in AkraID is written to an append-only audit trail. Each entry contains a SHA-256 hash of the one before it, so changing or deleting any entry breaks the chain from that point on. The database also refuses updates, deletes and truncation on that table.
Anyone with access, including your auditor, can run a check from the app that recomputes the whole chain and shows whether it's intact. The result goes in the evidence pack.
Application security
- A strict Content Security Policy: the app runs only its own scripts, with no inline code and no third-party scripts.
- Cross-site request forgery protection on every change, plus an origin check.
- Secure, HTTP-only, same-site cookies.
- Okta domains are validated so AkraID can't be pointed at internal networks.
- Exported spreadsheets are protected against formula injection.
- Customer organizations are kept apart at every query, and that separation is covered by automated tests that run on every change.
- The website you're reading uses no cookies, analytics or third-party scripts, and its fonts are served from our own domain.
Hosting and providers
AkraID runs in the United States. The database accepts connections only from AkraID's own servers over a private network, never from the internet.
| Provider | What for | Customer data? |
|---|---|---|
| Render | Runs the AkraID app and database (Oregon, US) | Yes |
| Cloudflare | DNS and this website | No |
| Microsoft 365 | Email with customers | Only what you email us |
We'll update this list before adding a provider that handles customer data.
What we don't have yet
AkraID is a young company. We don't have a SOC 2 report or a third-party penetration test yet. Both are on our roadmap. In the meantime, we're glad to walk your security team through the design, answer a questionnaire, and show the controls above working in a live demo.
Reporting a problem
If you think you've found a security issue, email [email protected] with "Security" in the subject. We'll reply within two business days. Please give us a reasonable chance to fix it before telling anyone else, and don't access data that isn't yours. We won't take legal action against good-faith research that follows these rules.