Overview
Refine is built on a custom auth system, a pluggable adapter architecture, and tenant-scoped AI. Below is exactly what that means in practice.
01AuthSessions, tokens, and credentials we control end to end.
Custom JWT authWe don't use a third-party auth provider. Access tokens are 15-minute JWTs; refresh tokens are 7-day JWTs stored as SHA-256 hashes in Postgres and rotated on every use. Reuse of a revoked token revokes every session for that user.
HTTP-only cookiesTokens never reach JavaScript. In production we set Secure + SameSite=Strict cookies under the __Host- prefix. CSRF-resistant by transport design.
Argon2id password hashingPasswords are hashed with Argon2id with parameters tuned for our hardware. We never store plaintext, never email your password, and never log credentials.
02DataTransport, storage, request limits, and the audit trail.
Encryption at rest and in transitAll data in transit uses TLS 1.2+ with modern ciphers. Object storage is encrypted at rest with AES-256 (SSE-S3 / SSE-KMS on R2). Database connections require SSL with a pinned CA cert.
Rate limiting everywhereAuth, share, and contact endpoints are rate-limited per IP and per token. Brute force is a non-starter. Webhook endpoints verify provider signatures before any state change.
Structured audit logsEvery meaningful action (auth, upload, share, billing) writes to an append-only activity log with a traceId correlated to the operational log. Settings surfaces your own audit trail; admins see theirs.
03AI isolationEmbeddings and share links stay scoped to one account.
Tenant-scoped AIFace embeddings live in a separate table with foreign keys that cascade on delete. They only ever match against your own photos. Embeddings from different models never coexist in the same searchable set.
Share-link isolationPublic share links are opaque tokens stored as SHA-256 hashes. They can be password-protected, set to expire, and revoked at any time. Passwords on links are hashed with Argon2id.
Face data, in particular
Face search is the most privacy-sensitive feature we ship. Here's exactly what happens to your data when you use it:
01You upload a selfie via the normal upload flow.
02The selfie is downloaded, scaled to a 1600px preview, and run through the face detector.
03One or more face embeddings are generated and compared against your photos only.
04The selfie is deleted immediately after the scan completes. We never reuse it, never store it.
05You can disable face indexing at any time, which deletes your existing embeddings.
What you can count on
Concrete, verifiable practices - not marketing language. Every item on this list is in production today.
Custom-built auth - no third-party identity provider lock-in. Passwords hashed with Argon2id; never stored or transmitted in plaintext. Tokens stored only as SHA-256 hashes; rotated on every refresh. HTTPS-only, HSTS in production, modern cipher suite, no TLS < 1.2. Tenant isolation enforced at the database level for every AI query. All public endpoints rate-limited per IP and per token. Webhook signature verification before any state change. Append-only activity logs with traceId correlation. Backups encrypted; tested quarterly for restore. Annual third-party security review (penetration test + dependency audit).
04DisclosureFound a vulnerability? We want to hear from you.
We work with security researchers and welcome coordinated disclosure. Our process is simple, fast, and respectful of your time.
02Include steps to reproduce, impact assessment, and any proof-of-concept code.detail
03We acknowledge within 24 hours and triage within 72 hours.ack
04We coordinate disclosure timelines - typically 90 days, faster for critical issues.timeline
05We run a public hall-of-fame for researchers who follow responsible disclosure.credit
Questions about our security model, compliance, or a specific control?
We answer security mail within 24 hours.