MACROSTRATEGIES

Compliance

This page lists what the service does. It is not a certification, and it makes no FedRAMP, ATO, Section 508, FIPS 140, or CJIS claim.

Sign-in controls

• Codes are 6 random digits, expire in 10 minutes, work once, and are tied to one sign-in.
• 5 wrong tries delete the code. A new code needs a new email.
• At most 5 codes per address per hour, 30 seconds apart, plus per-IP and per-address limits on sends and checks, and per-IP limits on /authorize and /token.
• Codes are sent only to addresses on the allow list. Other addresses see the same page and get no email.
• Only a SHA-256 hash of each code is stored. Comparison is constant time.
• Authorization codes last 2 minutes and work once. ID tokens last 5 minutes. PKCE (S256) is checked when sent.
• Fails closed: if a secret, the allow list, storage, rate limiting, or email is unavailable, nothing is sent and nobody is signed in.
• Pages send a Content Security Policy, deny framing, and use a host-only, HttpOnly, Secure, SameSite=Lax cookie for the sign-in step.

Data

• Stored: the email address and a code hash for up to one hour, then deleted by alarm.
• Shared: the email address goes to Cloudflare Access in the ID token, and to Cloudflare Email Sending to deliver the code.
• Logged: event names, the email domain, and a short hash tag. Never the code, token, or full address.

Accessibility

As of Oct 28, 2026, automated axe-core checks (WCAG 2.2 A and AA rules, run in CI on every change) report 0 violations on the sign-in, code, error, and info pages at 1280 and 390 pixels wide. Automated checks do not cover everything a manual review does.

Open-source licenses