Security
Built to be trusted with the keys to your network.
What Authcha does to protect your network, what it deliberately does not do, and where the limits are. Plain words first. The detail is in the specifications.
Signed releases, checked before they install.
Every download is verified before anything is installed. An update takes a backup first and rolls back by itself if something goes wrong.
Check it yourself: the installer is a readable script, signed with the same key as every release.
Your data stays on your server.
Authcha is single-tenant: one server, one database, one organisation. There is no Authcha cloud holding your data. The only calls home are the license check and the update check, and you can turn the update check off.
Delivery providers you configure, such as SMS or WhatsApp, are called from your server, not from ours.
Works when the internet does not.
Install and license with no internet. Logins never wait on the license: if it expires, only new people and devices pause. If your sign-in provider is down, a local emergency login stays.
Upgrades still need a connection for now.
A standby that stays in step.
A second server keeps a live copy of the data. If the main one fails, you promote the standby with one command, in about a minute.
Promotion is manual on purpose. There is no automatic failover.
Everything is on the record.
Every change an admin makes is written down: who, what, when and from where, with a link you can paste into a ticket. History is kept for 180 days by default, and you can change that.
Send events to your security monitoring tool over syslog or HTTPS.
Least privilege by default.
Admins, read-only viewers and front-desk sponsors each see only what their role needs. A sponsor cannot approve their own guest code. A second administrator can be required for sensitive changes.
Admins can sign in with a passkey or an authenticator code, and API tokens can have a maximum lifetime.
Secrets are protected.
Secrets are generated at install and never shown again. Passwords and API tokens are stored as hashes, and a built-in command rotates the encryption key.
No secret is written to the logs in plain text.
Backups that are tested.
A backup every 6 hours, with a checksum, kept for 14 days. Once a week Authcha restores one to prove it works, and records pass or fail.
You can show an auditor a history of passes, not just a file list.
What we don't claim.
Authcha has no SOC 2, ISO 27001 or similar certification, and its security documentation has not been reviewed by an outside auditor. Run your own assessment before production.
The shipped defaults suit a lab, not production. A pre-production checklist in the guide covers replacing self-signed certificates, requiring a second factor, setting a real quarantine network and removing lab-only test settings.
Report a vulnerability.
If you've found a security issue in Authcha, email security@authcha.cloud with the details and how to reproduce it.
Please give us a reasonable time to fix it before disclosing it publicly, and don't test against systems you don't own. The public demo is shared with other visitors, so please don't run load or denial-of-service tests against it.
See it work on real data.
The public demo has sample people, devices, guest codes and live logins. Sign in as an admin, a front-desk sponsor or a read-only viewer. Or install your own in one command.
- No credit card
- Every feature for 30 days
- Runs on your own server
$ curl -fsSL https://get.authcha.cloud | sudo bash -s -- --trial you@company.com ✓ Authcha downloaded and verified ✓ Authcha is running