Encryption and secrets
Exactly two database fields are encrypted. Five kinds of credential are stored only as hashes. Webhook signing secrets are stored readable.
What is encrypted
RealmSSO encrypts exactly two database fields, with AES-256-GCM. They are a connection's OIDC client secret and its SAML signing certificate.
The API never returns the OIDC client secret. The sign-in service holds its own working copy of it.
What is hashed
RealmSSO stores only a SHA-256 hash of each credential below. It does not store the credential itself.
| Credential | What RealmSSO stores | Lifetime and use |
|---|---|---|
| API key | A SHA-256 hash and an 8-character prefix | The key is ss_ followed by 64 hex characters. It appears once, when you create it. |
| SCIM token | A SHA-256 hash | Your customer chooses it. It has 32 characters or more. Each account has one SCIM token. |
| Dashboard sign-in link | A SHA-256 hash | It works once and lasts 15 minutes. Only the newest link works. |
| Refresh token | A SHA-256 hash | It lasts 30 days. Each use issues a new one. |
| Admin Portal invite token | A SHA-256 hash | It works once and lasts 30 minutes. |
What is stored readable
Webhook signing secrets are stored readable
RealmSSO does not encrypt or hash a webhook signing secret. The server needs the secret to compute the HMAC for each delivery.
A webhook secret has no rotation. Delete the webhook and create it again. See Webhooks API.
What RealmSSO's database does not hold
RealmSSO's database holds no secret for your application's sign-in client, no product client secret and no agent client secret. The sign-in service holds them, and RealmSSO keeps no copy. This site makes no claim about how the sign-in service stores them.
Where the keys live
The encryption keys sit in a key ring in the platform's secret store. Each encrypted value names the key that wrote it. One ring serves all accounts.
There is no KMS, no HSM and no customer-managed key. The key ring has no copy off the machine. If the ring is lost, the two encrypted fields cannot be read.
The ring supports rotation. A rotation adds a new key and moves the stored values onto it. No rotation has run in production. We have not measured a rotation, so we make no claim about downtime.
In transit
The public endpoints use HTTPS with Let's Encrypt certificates. The API sends an HSTS header with a one-year lifetime. This site makes no claim about TLS versions or cipher choices.
What this site does not claim
This site makes no claim about disk encryption, backup encryption or encryption of the connection to the database. See Backup, recovery and deletion for what backups hold. For the wider picture, see Security overview.