1App identity privacy & security notice

Identity information 1App keeps

1App keeps a stable canonical identity identifier and verified identity-provider binding so approved applications can recognise the same account without using email as the identity key.

Verified display name and email may be copied into the 1App identity profile for account display and controlled organisation administration. Organisation memberships and explicit application grants are stored separately from product-local permissions.

Authentication and sessions

Passwords and authenticator secrets remain with the Keycloak identity provider. 1App does not place Keycloak access, ID or refresh tokens in the normal application-session cookie.

The 1App browser cookie is an opaque session identifier. Session state is kept server-side, is revocable, and is subject to the current idle and absolute session limits.

Security and access evidence

1App keeps bounded identity-plane audit evidence for security, organisation membership, application access, lifecycle and provisioning events. Keycloak separately records authentication and security events under its reviewed retention settings.

Security evidence is not a substitute for product-local permissions or Sentinel business-action governance.

Relying applications

Applications that rely on 1App can keep their own application sessions, tenant data and operational permissions. 1App supplies identity and identity-plane access context; it does not silently merge those product data stores into 1App.

Acknowledgement

If you acknowledge this notice, 1App records only your canonical identity, this notice version and digest, and the acknowledgement time. The receipt does not record your IP address, device fingerprint or browser user agent.

Acknowledging this notice is optional in V1 and does not change otherwise-authorised access. It is not marketing consent, is not a waiver of rights, and is not blanket acceptance of future legal terms. If this notice changes materially, a new version can be presented separately.

Current stage

1App currently serves approved applications while broader standalone availability is developed. This notice describes the current 1App identity service; it is not a certification claim and does not replace a relying application's own privacy or product terms.