No token ever reaches the browser
The session lives on the server (Redis) and the browser only gets an opaque, httpOnly, SameSite=Lax cookie, Secure in production. The access token is never exposed to the client.
Security
Security is not a page: it is the architecture.
These are not good intentions. They are decisions already made in the code, verifiable on every request.
Single sign-on with PKCE
Authentication is OIDC with PKCE (S256) and a single-use state. The client identifier is public; there is no secret to steal in the frontend.
Session revoked in cascade
Signing out of one product signs you out of all. Each session can be revoked from the person’s account, and revocation reaches every system.
The server decides permissions
Role and access level are resolved on the server. The browser cannot escalate privileges because it takes no part in the decision.
CSRF and verified origin
Every writing request validates its origin. Internal back-office routes are unreachable from outside the proxy.
Passwords with bcrypt
Passwords are stored with bcrypt and never logged in clear. Recovery uses single-use codes with expiry.
Audit of access and changes
Every sign-in, every data change and every technical error is recorded with date, actor and outcome.
Data separated by company
Every query is filtered by the session’s company. No screen can return another company’s data by changing an identifier.
Where your data lives
Each product’s information is stored in its own PostgreSQL database, hosted on servers we administer. Identity — people, companies and permissions — lives in Cancebi ID. Products do not store passwords: the IdP validates them.
What we don’t do
- —We do not sell or transfer personal data.
- —We do not use one client’s data to train models.
- —We do not share databases between companies.
- —We do not access your account without a support reason and an audit trail.
Report a vulnerability
If you find a security flaw, write to privacidad@cancebi.com. We will reply and, if the finding is valid, fix it before publishing details.
Privacy policy →