Accounts and sign-in

  • You sign in once, on Zerethon's own account page (auth.zerethon.com), and the products recognise you from there. Individual products never see your password.
  • Passwords are never stored in readable form. You can also sign in with Google, in which case Zerethon never receives your Google password.
  • Sign-in uses the industry-standard OAuth 2.0 and OpenID Connect protocols, and sessions expire automatically.

For the general technique, see single sign-on across subdomains.

Keeping data separate

Each product keeps its own data separately. Your account is shared between products; your content is not, so a problem in one product does not give access to what you keep in another. See how the ecosystem is organised.

Processing in your browser

Most Zerethon Tools — formatters, encoders, hash and UUID generators, AES encryption — run entirely in your browser, so what you paste is not sent to our servers. Browser processing has limits of its own (a compromised device, a weak password); they are described honestly in browser-based encryption: what it protects.

Application safeguards

  • All products are served over encrypted HTTPS connections.
  • What you can see and change is checked on our side for every request, based on your role — not just hidden in the interface.
  • Actions that delete or archive something ask you to confirm first.
  • In Smart Edu, exam submissions are protected against tampering, so answers can't be altered or moved to another student's attempt.
  • If you install Flow in your application, it does not record SQL text or query values unless you turn that on, it hides secrets it encounters, and it sends nothing anywhere unless you connect it to the Flow dashboard.

What we don't collect

  • We don't sell personal data.
  • Tools don't log what you paste into client-side tools.
  • We never ask for cryptocurrency wallet private keys or recovery phrases. If anyone claiming to be Zerethon asks for them, it is a scam.

zerethon.com uses analytics and Google AdSense, which set cookies; what they collect and how to opt out is in the privacy policy.

Reporting a security issue

If you believe you have found a vulnerability in any Zerethon product, please email hello@zerethon.com with the subject "Security report", and include:

  1. the product and URL affected;
  2. steps to reproduce, and what an attacker could do;
  3. how we can reach you for follow-up questions.

Please don't access or change other people's data, don't degrade the service for others, and give us reasonable time to fix the issue before making it public. We will acknowledge your report and keep you informed. For the open-source flow-laravel package, the SECURITY.md in its repository describes the same process.