Account security

Summary#

Metric Vault authenticates you through a managed identity service, keeps you signed in with a short-lived session that renews itself, and checks on the server, not in the browser, whether you are entitled to each piece of work you ask for. Payments never touch our systems: Stripe handles them. This article explains what is actually in place, so you know what you are relying on and where the boundaries are.

Purpose#

Security documentation is only useful if it is exact. A vague page invites two bad outcomes: customers assume protections that do not exist, and support promises capabilities the product does not have. So this page describes the controls that are live today, plainly, and names the ones that are not.

Overview#

Four things protect the work in your account.

Your identity is managed by a dedicated authentication service. You sign in with an email address and password, or with Google. Passwords are held by that service, not by the Metric Vault application, and nobody at Metric Vault can read or set your password. The only way to change one is the flows described in Changing your password.

An address has to be confirmed before it counts. The server will not treat an unconfirmed email address as an identity, which means an address someone merely typed into a sign-up form cannot be used to reach an account.

Your session is a credential, not a cookie you have to manage. Signing in gives the browser a session that renews itself while you work and can be ended at any time from the app. Every request the app makes on your behalf carries that session, which is how the server knows the work belongs to you. Sessions and signing out covers the details, including Log Out All, which ends every session for your account on every device.

Entitlement is decided on the server. Whether you can run a tool, invite a teammate, use a premium feature or reach another workspace is decided by the server on every request. Hiding a button in the interface is never the control.

How it works#

Signing in#

• Two methods are offered on the sign-in page: Email Address and Password, or Continue with Google.
• A forgotten password is reset by an emailed link, which requires access to the mailbox on the account. See Changing your password.
• The sign-in page reports every failure with the same message, Invalid email or password. That is deliberate: an attacker cannot use the error text to work out which addresses have accounts.
• Set Password on the Account screen lets a Google-only account add a password, so you are not dependent on a single provider.

While you are signed in#

• The session is stored in the browser you signed in with, and each browser holds its own. Signing in on a laptop does not sign you in on a phone.
• The session refreshes itself shortly before it would expire, so a long working session is not interrupted.
• Requests the app sends to Metric Vault carry your session token, over HTTPS.
• Log Out ends the session in the browser you are using. Log Out All ends every session for the account, everywhere, immediately.

What the server checks on each request#

Two of these deserve a note because they behave in your favour rather than the system's convenience:

• The plan and quota checks fail closed. If Metric Vault cannot confirm your plan or your usage at that moment, the request is refused with a "temporarily unavailable, please retry" message rather than being waved through. You may see an occasional retry; you will not see someone else's entitlement applied to your account.
• Deleting saved work is authorised by your verified session, not by anything sent in the request body. A delete request can only ever remove rows that belong to the session making it.

Payments#

Metric Vault does not see or store card details. Checkout and the billing portal are operated by Stripe, and the app states this before you are sent there: Payment is handled by Stripe. We never see or store your card details. See Subscribing and checkout and Managing billing in the customer portal.

Programmatic access#

API keys exist on the Enterprise plan only. A key is created once, shown once, and can be revoked at any time. Every call made with a key re-checks the owning account's current plan, so a key stops working the moment the plan no longer qualifies. There are at most five active keys per account. See API keys.

Sharing#

Public share links are exactly that: Anyone with this URL can view "<title>" — no sign-in needed. Metric Vault tells you so in the dialog that creates the link. Treat a share URL as public, and only create one for a result you are willing to have read by anyone who receives it. See Sharing a result by link.

What is not available today#

Being straight about this matters more than sounding complete.

Good practice for your account#

• Use a unique password of at least eight characters, generated and stored by a password manager.
• Add a password to a Google-only account so you are not locked out if the Google account becomes unavailable.
• Run Log Out All after any password change, and immediately if a device is lost.
• Keep the mailbox on the account under your control. It is the route back in.
• Review who is in your workspace from time to time, and remove people who have moved on. See Removing a member.
• Treat public share links as public, and prefer exports for anything confidential. See Exporting results.
• Enterprise accounts: rotate API keys periodically and revoke any key whose purpose has ended.