Security at ONEWAY.

01Account security

• Sign in with passkeys, two-factor authentication, magic links or Google and GitHub.
• Passwords are stored only as secure hashes. Sessions expire, and sensitive actions require a recent sign-in.
• Sign-up, sign-in and password reset are rate limited and protected by Cloudflare Turnstile.
• Organisation roles control who can manage keys, billing, request logging and members.

02Data protection

• All traffic to the website, dashboard and gateway uses HTTPS with TLS.
• Each organisation's data is isolated at the database level with row-level security.
• Provider keys you bring are sealed with public-key encryption; only the gateway can decrypt them to make your requests.
• Request content is not stored unless your organisation turns on request logging, and then only for 1, 7 or 30 days.
• Our own staff access is limited, logged, and support access is read-only.

03API keys

API keys are scoped to a single project, can be revoked instantly from the dashboard, and are protected by per-project budgets and spend limits. Key creation, revocation and settings changes are recorded in your organisation's audit log.

04Reporting a vulnerability

If you believe you have found a security issue, email team@1way.dev with "Security" in the subject. Please include the affected URL or component, steps to reproduce and the potential impact. We will acknowledge your report within 3 business days and keep you updated as we investigate.

05Safe harbour

We will not pursue legal action against researchers who act in good faith and follow these rules:

• Only test against accounts and data you own, or with explicit permission.
• Do not access, change or delete other people's data; stop and report as soon as you encounter it.
• Do not run denial-of-service, spam, social-engineering or physical attacks.
• Give us reasonable time to fix the issue before sharing it publicly.

We do not run a paid bug bounty yet, but we are happy to credit researchers who help us.