Onelo handles your users' identities, sessions and payments. We don't treat security as a feature bolted on top — it's the thing you're paying us to get right. Here's exactly what protects every app, and what changes per platform.
Beyond the baseline, every request your app makes carries a proof of where it came from, and Onelo verifies it before doing anything. What that proof is depends on where your app runs:
Apple App Attest proves each request comes from a genuine, unmodified build of your app on real Apple hardware. The sign-in handshake is protected with PKCE (S256), so an intercepted login code can’t be reused.
Google Play Integrity confirms the request comes from your unmodified app, installed from Google Play, on a certified device. Sign-in is protected with PKCE.
On macOS and Windows, desktop builds are verified by their code-signing fingerprint (Apple codesign / Windows Authenticode) — a repackaged or unsigned build is turned away. Every desktop build is also bound by its app identity, and sign-in uses PKCE.
Browser apps are locked to your own domains with an origin allowlist and authenticated with a server-side client secret — only your site can call Onelo on your behalf. (No code to intercept, so no PKCE here.)
Server-to-server calls use a secret key and an optional IP allowlist, so only your own infrastructure can reach the privileged endpoints.
Bots, emulators, tampered and cloned apps are turned away before they reach your backend or your bill. Each proof is verified on Onelo's servers and tied to the specific request — it's one layer we apply alongside the rest, not a silver bullet, and we tier enforcement so genuine users on older devices aren't wrongly shut out.
Card data never touches Onelo's servers — or your app. All payments are processed by Stripe, a PCI Service Provider Level 1 (the highest tier). Onelo mints short-lived, scoped tokens for each checkout and records every money event with idempotency keys and two-phase commits, so a network blip can't double-charge a customer or lose a sale.
Auth endpoints are rate-limited per IP and per account, with credential-stuffing lockouts after repeated failures. Security events are logged with IP addresses anonymised — protecting your users and your bill.
Versioned Terms & Privacy consent is captured at signup and on every change, tied to the user and exportable for a DSAR or audit. We store a hash of the IP, never the raw address. Account deletion runs on a grace period with a full cascade.
Found a vulnerability? Email [email protected]. Report in good faith and we won't pursue legal action — we aim to acknowledge within 48 hours and will credit you once it's fixed.
Onelo is an independent product built by a small team. We are not yet SOC 2 or ISO 27001 certified, and we won't pretend otherwise. Everything described above is what we do today; formal certification is on our roadmap as we grow. If your use case needs a signed DPA or a specific attestation, email [email protected].