Privacy

This page describes what OneDoor PoC sign-in (https://signin.onedoor.team) does with your information. It is a proof of concept.

Signing in with Google

The service asks Google for the openid, email and profile scopes and nothing else. From the ID token Google returns it reads your Google account ID, your Workspace domain, your email address, whether Google verified it, your name, and when you signed in. It does not ask for offline access, and it neither keeps nor uses the access token Google returns, so it never calls Google APIs on your behalf.

A Google account without a Workspace domain (a personal Google account) is refused, and nothing about it is stored.

Your session counts from the time Google issued the token. When Google does not say when you last entered your password, the service marks that sign-in time as unconfirmed. The same holds for Microsoft.

Signing in with an email code

The service emails a six-digit code to the address you enter, through AgentMail. It keeps only a keyed hash of the code, which expires after ten minutes, and a count of attempts to enter a code for that address.

What it stores

• A person record: an ID the service assigns, an internal key derived from your first login, your name, your email address and whether it was verified.
• Each login that belongs to you: your Google account ID, your Microsoft tenant and object IDs, or your email address.
• Each session: how you signed in, your Workspace domain or Microsoft tenant, your IP address, your browser's user agent, and when it ends (eight hours after you signed in).
• Records of the codes and tokens it issues to the applications below.
• If you set up an authenticator app: its secret, encrypted with the service's key, and the last 30-second step you used a code from.

Who it shares with

Only the applications configured to use this service: OneDoor. When you sign in to one, it receives the person ID, your email address, whether it was verified, your name, how you signed in, your Workspace domain or Microsoft tenant, the ID of the login you used, and whether the sign-in time was unconfirmed. Apart from those applications, your email address goes only to the email service above, and only to send a code you asked for.

Removing your information

There is no self-service deletion. Email dstevens@gmail.com to ask for your records to be removed.

Home