Skip to content
Foliosodev
Sign in Get started
Menu
On this page

Security and privacy

Security overview

How Folioso protects your account, your organisation's content and the pages you share: sign-in protection, two-factor authentication, sessions, public links, uploads and the audit log.

Signing in

  • Passwords need at least 8 characters, with upper- and lower-case letters, a number and a symbol.
  • Repeated failed sign-ins are slowed down: after several wrong attempts for an address in a minute, sign-in for it is paused briefly.
  • The sign-in form doesn't reveal whether an account exists. A wrong password and an unknown address get the same answer, in the same time.
  • Password reset links expire after 60 minutes and don't sign you in by themselves.
  • GitHub and single sign-on link to an existing account only when the email address is verified on both sides, so nobody can claim your account by registering your address first.
  • Single sign-on never creates accounts. It only signs in people an admin has already added, and it checks membership again on every sign-in, so someone who's been removed can't keep signing in through your identity provider.

See Signing in.

Two-factor authentication

Anyone can turn on two-factor authentication with an authenticator app. It's required for admins and owners of an organisation with more than one member: until they set it up, the only page they can open is the setup page, their API tokens are refused, and they can't switch it off.

  • Codes can't be reused: a code that's just been accepted is refused if it's tried again.
  • Recovery codes work once each and are shown only when they're created.
  • Turning two-factor on forgets every device you'd asked Folioso to remember, so each needs a code at its next sign-in.

See Two-factor authentication.

Sessions

  • Changing your password signs out every other device and forgets remembered devices. The device you changed it on stays signed in.
  • Deleting your account signs you out everywhere at once.
  • Changing your email address emails the previous address, so a change you didn't make doesn't go unnoticed. If your account has a password, changing your email address or password asks for it first.
  • Changes to your email address and password are recorded in the audit log of every organisation you belong to.

Who can see what

Spaces are the permission boundary. Each person's access to a space comes from their space role (viewer, editor or admin), their teams, or a page shared with them directly. Private pages are visible only to their author and the people they're shared with. Each member's personal space ("My space") is visible only to them, and not to organisation admins.

Folioso doesn't confirm whether a page or organisation exists to people who can't see it: they get the same "not found" answer as for something that doesn't exist.

See Permissions.

  • Kept out of search engines. Every public link page tells search engines not to index, follow, archive or snippet it, and search engines are asked not to crawl public links at all. Link previews in chat apps still work, so a shared link still unfurls.
  • Optional passwords. You can protect a public link with a password (6 to 72 characters). The page isn't shown until the password is entered, and the password prompt shows nothing from the page. Wrong guesses are rate-limited.
  • Changing or removing the password ends access for everyone who unlocked the link with the old one.
  • Read-only or edit. You choose whether a link lets people edit.

See Public links.

Uploaded images

Every image you upload is checked by its actual contents, not just its file name, and then re-encoded by Folioso into a new WebP file. The original file is never served as it was uploaded. Uploaded images get random names, so an image's address can't be guessed from another.

See Images.

API tokens

  • Each token is bound to one organisation and only works at that organisation's address.
  • A token can be read-only or read-and-write, and can never do more than the person who created it.
  • Folioso stores only a fingerprint of each token. The token itself is shown once, when you create it.
  • Tokens can be given an expiry date and revoked at any time.

See API tokens.

Audit log

Organisations record security-relevant events in an audit log: invitations, membership and role changes, ownership transfers, email and password changes, suspensions, space access changes, sharing and public links, page visibility changes, organisation settings, single sign-on and domain changes. Each entry records who did it and when.

Recording is always on, on every plan. Viewing and exporting the log needs a plan that includes the audit log. Entries are kept for 365 days.

See Audit log.

Your data

For how long things are kept, how to export your data and what deleting your account erases, see Data and privacy.