Inside KeyForge:
Our Security Architecture

JWT rotation, bcrypt password hashing, rate limiting, CSRF protection, and why we chose Neon over self-managed Postgres.

JWT & session management

Access tokens live 15 minutes. Refresh tokens live 30 days, rotate on use, and live in HttpOnly cookies with SameSite=Strict. We don't store session IDs in localStorage — ever.

Password storage

Passwords are bcrypt-hashed before they hit the database. We never see your plaintext. Failed login attempts are capped per-IP and per-account with exponential backoff.

Why Neon

Managed Postgres with branching, connection pooling, and point-in-time recovery out of the box. We traded some control for operational sanity — and we sleep better for it.

What we still don't claim

We don't have SOC 2. We don't have an enterprise SLA. We don't claim immunity to breaches. We claim: transparency, defense in depth where it matters, and honest disclosure when things go wrong.