Security

You're trusting us with your work. Here's how we look after it, and where we're not there yet.

Signing in

There are no passwords, so there are no passwords to steal. On Tethr, you sign in with your phone number and a six-digit code from an authenticator app. The code changes every 30 seconds and works only once.

On Authr, the first choice is a passkey: your phone or computer's fingerprint, face or screen lock. A passkey works only on authr.svair.org, so a look-alike site gets nothing it can use, and we store only its public half, which can't sign anyone in. The six-digit code works on Authr too, if you prefer it.

A new computer can be let in from a device where you're already signed in. The new computer shows a code that lasts five minutes, and you approve it on the other device with your passkey or a fresh code.

Five wrong codes in fifteen minutes and that number is locked out for a while. On Authr, a stranger guessing at your number can't lock you out of the device you already use.

The secret behind your codes is encrypted before we store it. If you don't ask to stay signed in, you're signed out after 30 minutes of doing nothing. On Authr, staying signed in lasts 30 days at most, and ends sooner if you don't use it for 14. It's ticked to start with, so untick it on a shared computer. Your Authr account page lists every device you're signed in on, and signs out the ones you don't recognise.

Your data

Everything between your device and our servers is encrypted in transit. Stored data is encrypted on disk by our hosting provider.

Tethr's data is stored in India. Your work is kept separate from everyone else's, and attachments and book pictures sit in private storage, not on public links.

Authr is one service that every writer shares. Nobody gets a copy of their own, so what keeps your drafts yours is our server checking, on every request, who may read or change each book.

Who can see it

Only the people who build Svair, and only to help you or fix something. We can view an account read-only: we see what you see, but we can't change anything. Every time, it's logged. On Authr, each look lasts an hour at most, starts with a written reason, and can't download your books.

What we haven't done

We don't have a SOC 2 or ISO 27001 certificate. We're a small company, and those audits are built for companies with a compliance department. We'd rather tell you that than imply otherwise.

We don't run our own servers either. We use established hosting providers and pick boring, well-tested tools on purpose.

If something goes wrong

If we find a security problem that affects your data, we'll contain it, investigate it and tell you as soon as we reasonably can: what happened, what was affected and what we're doing about it.

Found a vulnerability?

We'd much rather hear it from you than read about it online. Write to hello@svair.org.

Tell us what you found, where, and how to reproduce it. Test only with your own account, never against someone else's, and stop as soon as you can show the problem.

Give us a fair chance to fix it before you tell anyone else. If you act in good faith, so will we.

One last thing

Security is never finished. It's finding the weak spot and making it stronger, then finding the next one.

This page will change as we do that.