AuthJet terms

1.What these terms cover

With AuthJet, we sign your end users in to your apps and keep their accounts: their profiles, credentials, sessions, roles and permissions. These terms cover every end user account your apps hold in AuthJet, whatever sign-in method it uses.

2.Controller and processor

Your end users' accounts are customer data. For the personal data in them, you are the controller and Substrio is your processor: we store and process it only to sign your end users in, keep their accounts and apply the permissions your apps set, as the platform terms describe.

You are responsible for:

1. the privacy notice and terms you show your end users, which name your app as the party that holds their account;
2. the lawful basis for every field you collect about them, including custom profile fields;
3. answering their requests to access, correct, export or delete their data, with AuthJet's user management operations;
4. deleting the accounts of end users who ask for it, or whom your app no longer serves, when the law requires.

3.Credentials

What we do. We store passwords hashed, never in clear. End users sign in by email code, password, passkey or a social provider, with two-factor sign-in available. We lock an account after repeated failed sign-ins until its password is reset, and refuse two-factor codes for a time after repeated wrong ones.

What you do. Your apps send credentials only to AuthJet's sign-in calls, over HTTPS, and never log, store or forward an end user's password, one-time code or recovery code. Session tokens your apps receive are secrets: keep them out of URLs and logs, and end a session when its end user signs out. Offer two-factor sign-in to your end users where your app holds data that warrants it, and require it for your members.

You may not use AuthJet to collect credentials for a service other than your app, or to test credentials gathered elsewhere.

4.Social sign-in providers

When your end users sign in with a social provider, such as Google, GitHub, Apple or Microsoft, that provider's terms and privacy policy apply to them and to the data it shares. Each provider decides what it shares and may change, limit or stop it; we cannot sign an end user in through a provider that refuses the sign-in.

You use the profile data a provider shares only for your app's sign-in and account purposes, as that provider's developer policies allow, and you offer your end users another way to sign in if a provider becomes unavailable to them.

5.Account takeover

An account takeover is an end user's account used by someone else. To prevent and answer one:

1. you keep your apps' sign-in, recovery and email change flows on AuthJet's calls, without shortcuts that skip their checks;
2. you watch for and act on unusual sign-in activity in your apps, such as many accounts signed in from one source;
3. when you learn of a takeover, you end the account's sessions, disable it or reset its credentials with AuthJet's operations, and tell the end user;
4. you tell us through the console at once if a takeover may involve a fault in AuthJet.

We may lock end user accounts, end sessions or refuse sign-ins from a source when we see an attack on your app or on the service, and we tell you when we do.

6.Roles and permissions

We keep the roles, memberships and permissions your apps grant your end users, and answer your apps' permission checks. You decide what each role may do; a permission you grant too widely is yours to correct. Test your rules before your app relies on them.

7.Deleting and impersonating end users

Deletion. Deleting an end user (user.delete) marks the account deleted; its hard option erases it. When the law gives an end user the right to erasure, you use the hard option.

Impersonation. Your members can sign in as an end user to see what that end user sees (user.impersonate). Use it only to support that end user or to run your app, only as your privacy notice to your end users allows, and end the session when the work is done.

8.When your use ends

Before you delete an app or move your end users to another sign-in service, read out what you need of their accounts (user.list). When you delete an app, we delete its end user accounts with the rest of its data, as the platform terms describe.