Ephemetry runs as a Cloudflare Worker with narrow collectors, prepared D1 queries, tenant-scoped authorization, and hosted payment pages.
Passkeys provide phishing-resistant WebAuthn sign-in with required local user verification and exact relying-party and origin checks. Passwords are HMAC-peppered before PBKDF2-HMAC-SHA256. Optional TOTP uses encrypted secrets, replay-resistant counters, and hashed one-use recovery codes. Password reset signs out browser sessions while preserving stronger factors.
Every request is checked against the selected workspace and role. Owners control members and billing; admins manage sites; viewers have read and export access. Invitations are email-bound, single-use, expire after seven days, and are stored only as token hashes.
Remote MCP connections use OAuth authorization code flow with S256 PKCE, exact callback matching, short-lived access tokens, rotating refresh tokens, and hashed credentials at rest. Grants are bound to one user and workspace. Tools are read-only and revocation invalidates every token under the grant.
Each event is size-limited, schema-validated, origin-checked, rate-limited, and stripped of likely personal data before prepared insertion. Experience telemetry writes directly to aggregate counters.
Card entry and subscription self-service happen on Dodo Payments. Webhooks require Standard Webhooks signatures, timestamp freshness, and idempotent event IDs.
Strict browser security headers, a no-referrer policy, privacy-safe logs, automated retention cleanup, D1 Time Travel, and secret-only API credentials reduce avoidable exposure.
Please send vulnerability details to support@ephemetry.com. Include the affected URL, impact, and reproduction steps. Do not access other users' data, disrupt the service, or publish sensitive details before there has been time to investigate and remediate.