Legal
Privacy Policy
Last updated: November 1, 2026
This policy explains what personal data SAUTH processes, why, and the choices you have. It covers our website, dashboard and APIs.
Two kinds of data
- Your account data. When you or your team use SAUTH, we are the controller of your account information.
- Your end users' data. When your software authenticates its users through SAUTH, you decide what is collected and why. We process that data on your behalf, only to provide the service, as your processor.
What we collect
| Data | Why |
|---|---|
| Name, email, password hash, Google account identifier | To create and secure your account |
| Sign-in history: IP address, browser, time, outcome | To detect suspicious sign-ins and show you your session history |
| Contact form submissions, including your IP address | To reply to you and to prevent spam |
| End-user records you manage: usernames, emails, license usage, IP addresses, keyed hashes of hardware IDs | To authenticate your users and enforce your licensing rules |
| Audit logs of changes in your organization | Security, accountability and support |
Passwords are stored only as Argon2id hashes. Hardware IDs are stored as keyed hashes. License keys, signing keys and two-factor secrets are encrypted at rest.
Cookies and local storage
We use a strictly necessary session cookie to keep you signed in to the dashboard, and your browser's local storage to remember your theme choice. We do not use advertising or cross-site tracking cookies.
Retention
- Authentication logs: according to your plan's retention period (7–30 days by default).
- Audit logs: up to 365 days.
- Expired sessions: 30 days, for your session history.
- Sign-in attempts: 90 days.
- Account data: until you delete your account, then removed after a short grace period.
Service providers
We use infrastructure providers to run SAUTH, including managed PostgreSQL hosting (data hosted in Singapore), managed Redis hosting, and Cloudflare for network protection and file storage. They process data only on our instructions.
Your rights
You can access, correct, export or delete your account data, and object to or restrict certain processing. End users of applications built with SAUTH should contact the application's vendor first; we will help vendors fulfil those requests.
Contact
For privacy questions or requests, use our contact form. We will update this page when our practices change and note the date above.