Security & compliance
Qeet ID is built for teams that have to prove their controls. Tamper-evident audit, asymmetric token signing, passkeys, and an encrypted vault — secure by default, and open enough to verify yourself.
Each pillar below is implemented and tested in the platform today — not a brochure promise.
Every audit event is append-only and SHA-256 hash-chained to the one before it. A /verify endpoint recomputes the chain, so any altered or deleted row is provably detectable — a genuine differentiator over mainstream CIAM.
ID tokens are signed with ES256 (ECDSA P-256), published at a standard JWKS endpoint with RFC 7638 key IDs. A retired-key grace window and an algorithm-confusion guard keep verification safe through rotation.
Phishing-resistant FIDO2 passwordless login and registration, plus WebAuthn as a second factor and step-up verification gating sensitive actions. Built on go-webauthn with full credential management.
Passwords are hashed with Argon2id at OWASP parameters, with format-detecting verification, rehash-on-login (bcrypt migration path), and timing-safe comparison. Breached passwords are rejected via HIBP k-anonymity.
Per-tenant secrets are sealed with AES-256-GCM. Keys are sourced through a KeyProvider abstraction decoupled from the JWT secret, so AWS KMS (BYOK / envelope encryption) drops in without code changes.
Per-tenant roles and groups with a single-call /check API, effective-permissions queries, and an ABAC policy engine. Explainable authorization returns the exact grant-path trace — which role or group allowed it, or why it was denied.
Be a SAML IdP and SP, an OIDC provider, and a SCIM 2.0 Users + Groups endpoint — RSA-SHA256-signed assertions, JIT provisioning, and PatchOp membership sync, none of it paywalled behind an enterprise tier.
Refresh-token rotation with theft detection, per-account lockout, distributed Redis rate limiting, CSRF + security headers, and a production boot-gate that refuses to start with insecure defaults.
We're candid about what's achieved versus in progress. Self-hosting also lets you inherit Qeet ID into your own compliance boundary.
Right-to-erasure (async PII purge with the audit trail preserved), data export, and retention auto-purge are implemented today.
Controls are in place; an independent Type II audit is scheduled ahead of GA.
An ISMS is being formalised toward certification by an accredited body.
Hosted EU / US regions, or self-host anywhere — including a customer VPC or air-gapped network.
Self-hosting already lets covered entities keep PHI inside their own boundary; a managed BAA is planned.
An external penetration test is scheduled before GA; findings will be remediated and summarised for customers.
Choose a hosted EU or US region, or run the single Go binary on your own infrastructure. When you self-host, customer data never leaves your boundary — the strongest residency guarantee there is.
Everything is partitioned by tenant_id across the user, auth, RBAC, audit, and platform schemas. Switching tenants re-mints a freshly scoped token.
Webhooks are HMAC-SHA256 signed and delivered through a transactional outbox with exponential-backoff retries and a dead-letter queue, so downstream systems get a verifiable, durable event stream.
Scoped, expirable, hashed API keys plus OAuth client_credentials for service-to-service auth — every machine principal is auditable and revocable.
Found something? We want to hear about it. Good-faith research keeps everyone safer, and we'll work the issue with you.
security@qeet.in25,000 monthly active users on the house. Production-grade auth, no credit card, no time limit.