Security is the reason Providame exists
We built Providame specifically so your team never has to reinvent tenant isolation, credential storage, or token handling from scratch. Here's how it actually works under the hood.
Three properties, doing the heaviest lifting
The rest are on by default, everywhere — nothing here is something you opt into.
Real tenant isolation
Every environment gets its own isolated organization and end-user pool — the same email can exist independently across dev, staging, and prod without ever colliding.
Keys hashed at rest
Every publishable and secret key is SHA-256 hashed with a separate lookup index — the raw hash never returns to any client, and secret plaintext clears after its one-time reveal.
Short-lived tokens
Access tokens expire in seconds, not hours — revocation works by simply not renewing, instead of chasing long-lived tokens across your infrastructure.
HttpOnly, Secure, SameSite cookies
Never in localStorage, never readable by client-side JavaScript.
Breach-password protection
Checked against Have I Been Pwned using k-anonymity — only a 5-char hash prefix ever crosses the network.
Bot detection
Cloudflare Turnstile on platform and end-user sign-up flows.
Full audit trail
Every workspace mutation recorded — member changes, key rotations, app deletion.
Rate limiting everywhere
Per IP, per API key, and per identifier on every endpoint.
What we store, and what we never see
Passwords
Never stored or handled in plaintext, anywhere — only a salted, one-way hash is ever stored, and it's never returned to any client.
Private metadata
Never exposed to an end-user's own frontend under any circumstance — only your dashboard and your own backend (via a secret key) can read or write it.
Have a question about our security posture that isn't covered here? Get in touch.
Read the fine print
Our Terms of Service and Privacy Policy cover how we handle your data in full detail.