# Security

> What Toolaby prevents, what it cannot, and how your data is kept.

## Entitlement

* Entitlement is a JWT signed with your workspace's ES256 key, bound to one device, valid for 15 minutes. The private key never leaves Toolaby; the extension only verifies.
* Every request that can change access is signed by a key made on the device, which cannot be exported.
* The extension link that makes a signed-in device trusted is stored as a hash, bound to one device, narrow in scope, expiring and revocable. The buyer's browser session never reaches the extension.
* Licence keys are stored as hashes. Devices per licence are capped.
* A licence checked by one device from eight networks within an hour, eight times within thirty days, is flagged for your review. It keeps working; the customer's page shows the flag and the workspace's owners are mailed once. Revoking is yours. See [Customers](https://toolaby.app/docs/customers.md#actions).
* Trials need a verified address from a non-disposable domain, one per inbox per tool, whether Toolaby starts it or Stripe does at checkout. The inbox is kept as a keyed hash.

## What cannot be prevented

The extension runs on the buyer's machine. Someone who edits its JavaScript can skip a check made inside it. What Toolaby does — counting uses, issuing tokens, authorising downloads — cannot be skipped; a feature computed entirely inside the extension is protected only as well as any client-side software.

## Your workspace

* Buyers live in a pool per workspace; another workspace cannot read them.
* API keys are stored as hashes and shown once.
* Webhook secrets are held by Svix.
* The signing key is sealed at rest and revealed only in an export you request.

## Buyers' data

* Buyer data is stored in the EU: the database and the application in Frankfurt, email sent from Stockholm. See [Your data](https://toolaby.app/docs/your-data.md).
* From a customer's page you can download a person's data and erase them. Erasure removes the person and keeps purchases for the tax record.
* Deleting an account, by the buyer, cancels their subscriptions and ends their sign-in; licences bought under the address remain as purchases.