Privacy
This page describes what OneDoor PoC sign-in (https://signin.compoundingmemory.com) does with your information. It is a proof of concept.
Signing in with Google
The service asks Google for the openid, email and profile scopes and nothing else. From the ID token Google returns it reads your Google account ID, your Workspace domain, your email address, whether Google verified it, your name, and when you signed in. It does not ask for offline access, and it neither keeps nor uses the access token Google returns, so it never calls Google APIs on your behalf.
A Google account without a Workspace domain (a personal Google account) is refused, and nothing about it is stored.
Signing in with an email code
The service emails a six-digit code to the address you enter, through Amazon SES. It keeps only a keyed hash of the code, which expires after ten minutes, and a count of attempts to enter a code for that address.
What it stores
- A person record: an ID the service assigns, an internal key derived from your first login, your name, your email address and whether it was verified.
- Each login that belongs to you: your Google account ID, your Microsoft tenant and object IDs, or your email address.
- Each session: how you signed in, your Workspace domain or Microsoft tenant, your IP address, your browser's user agent, and when it ends (eight hours after you signed in).
- Records of the codes and tokens it issues to the applications below.
Who it shares with
Only the applications configured to use this service: OneDoor. When you sign in to one, it receives the person ID, your email address, whether it was verified, your name, how you signed in, your Workspace domain or Microsoft tenant, and the ID of the login you used. Apart from those applications, your email address goes only to the email service above, and only to send a code you asked for.
Removing your information
There is no self-service deletion. Email dstevens@gmail.com to ask for your records to be removed.