Skip to content

Security

How we protect your permissions data

Permio sits in the path of every access decision your app makes, so we keep the design simple and the facts on this page short and checkable. We’re an early-stage company: we don’t hold SOC 2 or ISO certifications yet, and we’d rather tell you that than imply otherwise.

API keys and authentication

  • Opaque keys, shown once. API keys are random perms_… strings. The full key is shown only when it’s created; we store a SHA-256 hash, never the key itself.
  • Scoped access. A key is either check-only (the default: checks, list filtering, “who has access”, and reading permissions and roles) or full access (also creating, changing and granting). Give each service the least access it needs.
  • Revocable. Invalidating a key stops it working immediately, and its grants are removed.
  • Every request is authenticated. The dashboard uses Firebase ID tokens; your backend uses API keys sent as a bearer token.

Keep keys on your server. A key in a browser or mobile bundle can be read by anyone who loads it. See API keys in the docs.

Authorisation model and fail-closed checks

  • A check passes only when the principal holds every requested permission on every requested resource, directly, through a role, or through a group.
  • Checks fail closed. A resource with no applicable grant is denied. Grants flow down the resource tree, never up or sideways, and never across projects.
  • An API key is itself a principal with a role on its project, so a key can only act within the project it belongs to.

Audit log

The dashboard keeps an audit log and activity feed of changes to permissions, roles, grants, groups and API keys, so you can see what changed and when. The Access tester shows which grants and inheritance led to any allow or deny.

Infrastructure and data location

  • Services run on Google Cloud Run in the London region (europe-west2).
  • Data is stored in MongoDB Atlas.
  • Dashboard sign-in uses Firebase Authentication.
  • Payments are handled by Stripe; we don’t store card details.
  • All traffic uses TLS.

See the privacy policy for the full list of subprocessors and how personal data is handled.

Reporting a vulnerability

If you think you’ve found a security issue, email security@perms.io with the details and steps to reproduce. Please give us a reasonable chance to fix it before sharing it publicly. We’ll acknowledge your report and keep you updated.