What we store, how, and for how long.
SignOps holds your push keys and your users' devices. This page is the plain account of how each is kept, written for the developer who has to answer their own security review.
- Firebase (FCM)kirana-express-prod · service accountConnected
- Apple (APNs)Key ID 8K2Q9XW4LM · Team 5HD3K7P2TQConnected
- Web pushVAPID key pair made by SignOpsConnected
Your push keys
Firebase service accounts and APNs keys are encrypted per app with AES-256-GCM, under a master key that never sits in the database. After upload they are never shown again, to you or to us in the dashboard.
Approve
Each trusted phone holds a P-256 private key in the Android Keystore or iOS Secure Enclave. Every approval is a fresh challenge signed by that key and checked against its public key. Number matching is on for every request.
Email OTP
Codes are stored only as an HMAC SHA-256 hash under a key held outside the database, compared in constant time, spent on first success and gone after 10 minutes or 5 wrong tries.
Passkeys
SignOps stores public keys and credential ids. Private keys stay on the user's device or in their password manager. Faces and fingerprints never leave the phone.
Webhooks
Every event is signed with HMAC SHA-256 over a timestamp and the body. Libraries reject signatures older than 5 minutes, so a captured event cannot be replayed.
API keys
Secret keys for servers and publishable keys for apps, separate for live and test. Keys are stored hashed, shown once, and can be rotated with 24 hours of overlap.
Where it lives.
SignOps stores the least each product needs to work, and deletes it on a schedule.
| Data | Stored in | Kept for |
|---|---|---|
| Device tokens and platforms | Cloudflare D1, Asia-Pacific | Until removed, or 90 days unseen |
| User ids | Cloudflare D1, Asia-Pacific | While any device or passkey exists for them |
| Push message logs | Cloudflare D1, Asia-Pacific | 7 days, 30 on Pro |
| Approval requests and answers | Cloudflare D1, Asia-Pacific | 90 days, 1 year on Pro |
| OTP hashes | Cloudflare D1, Asia-Pacific | Deleted 24 hours after expiry |
| Email addresses for OTP | Amazon SES, Mumbai | As SES needs to send and suppress |
| Raw outgoing email | Cloudflare R2, Asia-Pacific | 7 days |
| Passkey public keys | Cloudflare D1, Asia-Pacific | Until removed |
You are the data fiduciary. We process for you.
Under India's Digital Personal Data Protection Act, 2023, SignOps processes your users' data on your instructions and for nothing else: not for sale, not to contact your users, not for training. A data processing agreement is available on request.
Found a vulnerability?
Email security@signops.dev with the details. You get a reply within two working days, and we will not take action against research done in good faith that avoids other customers' data.
Questions from your security review?
Email security@signops.dev. The answer goes on this page if others will need it too.