AuthLN
Book a review

Security and trust

What we hold, what we don't, and how to check.

We ask you to check the record instead of taking anyone's word. The same goes for us: here is what we hold, what we never hold, and where to check.

Visit the Trust CenterIncident response

Assurance

Patents, audits and the Trust Center.

Patents

Two issued U.S. patents

US 11,956,366 and US 12,118,550.

SOC 2

Type I completed

SOC 2 Type I completed; Type II examination underway, report expected Q3 2026.

Trust Center

trust.authln.com

Policies, controls and documents for your security review.

Open the Trust Center

Data handling principles

The least we need, for the shortest time.

No keys to steal

AuthLN does not store end-user private cryptographic keys. The proof is produced on the person's device, never on yours.

Your identity provider stays yours

We hold no directory and no lifecycle. Your directory, your policy and your lifecycle are unchanged, and enforcement policy and group scoping live in your tenant, not ours.

Read-only, and never secrets

An Agent Access Review runs from read-only exports, with nothing installed. We never need passwords, API keys, tokens or connection strings, and we ask you to leave out content: prompts, message bodies and file contents.

Deleted, and confirmed in writing

Review data is deleted at the end of the engagement, and we confirm it in writing. Authentication telemetry is retained no longer than 45 days by default, as our Privacy Policy sets out.

Inside your own boundary

If anything is CUI or export-controlled, the review can run inside your GCC High or GovCloud tenant, and only the report leaves.

Data processing aligns with NIST SP 800-53 Rev. 5 and ISO/IEC 27001:2022. See the Data Processing Addendum.

Documents

Questions

Security questions? Ask us directly.

Talk to us about our security program, subprocessors or how a review handles your data.

Contact usTrust Center