Trust Through Transparency.

We believe identity should be self-hosted, un-phishable, and verifiably secure. Discover how FamilySSO uses modern cryptographic standards and stateless infrastructure to protect you.

Stateless Architecture

Legacy identity providers use centralized databases susceptible to massive data breaches. FamilySSO flips this model entirely by utilizing stateless workers. Requests are handled immediately and load-balanced organically, eliminating the centralized database bottleneck.

Zero Trust & Defense in Depth

Security isn't a perimeter; it's woven into every protocol. We operate on a strict Zero Trust model. Every request is strictly analyzed for rate limits, payload integrity, and CSRF patterns.

  • Envelope Encryption & Key Splitting: The core database cannot be blindly dumped. The Master Key is securely split (via HKDF) combining system configurations, code constants, and database-level peppers. All user information is encrypted by a unique key per tenant, remaining cryptographically locked in AES-256-GCM.
  • Blind Indices for PII: Email addresses and usernames are never queried in plaintext. We perform constant-time searches against salted, HMAC-SHA512 blind indexes.
  • Strict 512-bit Standards: We have deprecated weak hashing. Every hash, signature, and iteration relies on native WebCrypto SHA-512 standards (e.g. PBKDF2-SHA512).

Continuous AI-Auditing

What truly makes FamilySSO different is how it was built. As an open-source project, our codebase isn't just publicly reviewable—it relies on continuous, agentic testing and auditing from Opus 4.6 and Gemini 3.1 Pro. The AI coding agents have strict rules to enforce the highest security configurations possible across our infrastructure.

← Back to Overview