Security

Security is not a checkbox — it is the contract you sign every time you trust Createrun Identity with a credential. This page summarises how we protect your account and how you can help us do that.

How we protect your account

• Modern password hashing — credentials use salted hash functions tuned for current hardware. We never log, transmit or store plaintext passwords.
• TLS everywhere — every endpoint (/connect/authorize, /connect/token, /connect/userinfo, the admin API) requires TLS 1.2 or newer.
• Brute-force protection — repeated failed sign-ins lock the account temporarily and write to the audit trail.
• Session controls — every active relying-party session is listed under Devices & sessions; revoking one immediately invalidates that client's tokens.
• Short-lived access tokens — tokens default to 15 minutes with rotating refresh tokens; you re-authenticate at most once per day.
• Audit log — every sign-in, lockout, role change and consent decision is recorded with correlation id, source IP and user agent.

How you help

• Pick a unique password (at least 12 characters, mix of cases, digits and symbols).
• Enable multi-factor authentication if your tenant offers it.
• Review your active sessions periodically and revoke anything you do not recognise.
• Treat email links as suspicious until you have confirmed the sender; we will never ask for your password by email.

Reporting a vulnerability

Security researchers can email security@createrun.com with PGP encryption (key fingerprint published on the help page). We acknowledge reports within two business days, prioritise fixes according to severity and credit valid disclosures in our release notes when permitted.