How this account is kept

Reporting something

Write to security@hmcortex.com. A first reply comes within three working days. Report in good faith, do not use anyone else's account or data to demonstrate a problem, and we will not pursue you for it.

How sign-in works here

• Your password never reaches a page script. These pages load no script at all — the policy they are served under forbids it — so there is nothing on them that could read a field, and nothing an injected tag could hook into.
• Your session cookie is bound to this host and cannot be read by any other, including any other name under hmcortex.com. It is marked so browsers keep it from scripts entirely, and on a deployed site it is marked to travel only over an encrypted connection.
• Every form states where it came from, and one that will not is refused before it reaches the authentication service — the same rule in every environment, checked against the deployment rather than only in a test.
• Signing in is done from the server. Your browser never talks to the authentication service directly, so nothing running in a page can ask it for anything as you.

Reaching your account data

The pages that show your organisation and preferences are built on the server. The credential that reads them is minted for a single request and dropped when it ends: it is never placed in a page, never stored in your browser, and cannot be recovered from anything this surface sends you.

Between services, that credential is checked with public-key signatures against a published key set — the service that reads it holds nothing that could mint one.

What is not built yet

• Two-step sign-in. The authentication service has no second factor. Nothing on this surface pretends otherwise.
• Withdrawing an invitation. An invitation closes when its link expires, seven days after it is sent.
• Signing in to the desktop app from here. The app signs in on its own; the links on these pages only say where to go, never as whom.