Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions src/partials/auth-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,19 @@

Password history prevents users from reusing recent passwords. This protects user accounts from security risks by enforcing a new password every time it's changed.

Password history can be enabled in the Auth service's **Security** tab on the Appwrite Console. You can choose how many previous passwords to remember up to a maximum of 20 and block users from reusing them.
Password history can be enabled in the Auth service's **Security** tab on the Appwrite Console. You can choose how many previous passwords to remember, up to a maximum of 20, and block users from reusing them.

# Password dictionary {% #password-dictionary %}

Password dictionary protects users from using bad passwords. It compares the user's password to the [10,000 most common passwords](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) and throws an error if there's a match. Together with [rate limits](/docs/advanced/platform/rate-limits), password dictionary will significantly reduce the chance of a malicious actor from guessing user passwords.
Password dictionary protects users from using bad passwords. It compares the user's password to the [10,000 most common passwords](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) and throws an error if there's a match. Together with [rate limits](/docs/advanced/platform/rate-limits), password dictionary will significantly reduce the chance of a malicious actor guessing user passwords.

Password dictionary can be enabled in the Auth service's **Security** tab on the Appwrite Console.

# Password hashing {% #password-hashing %}
Appwrite protects passwords by using the [Argon2](https://github.com/P-H-C/phc-winner-argon2) password-hashing algorithm.
Argon 2 is a resilient and secure password hashing algorithm, which is also the winner of the [Password Hashing Competition](https://www.password-hashing.net/).

Argon 2 is a resilient and secure password hashing algorithm that is also the winner of the [Password Hashing Competition](https://www.password-hashing.net/).

Appwrite combines Argon 2 with the use of techniques such as salting, adjustable work factors, and memory hardness to securely handle passwords.

If an user is imported into Appwrite with hash differnt than Argon2, the password will be re-hashed on first successful user's sign in. This ensures all passwords are stored as securely as possible.
Expand Down
10 changes: 5 additions & 5 deletions src/routes/docs/advanced/security/gdpr/+page.markdoc
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
---
layout: article
title: GDPR
description: The safeguarding of your and your users' data is taken seriously at Appwrite. Learn about Appwrite's measures and compliance with European General Data Protection Regulation (GDPR).
description: The safeguarding of your and your users' data is taken seriously at Appwrite. Learn about Appwrite's measures and compliance with the European General Data Protection Regulation (GDPR).
---

Appwrite is compliant with the European General Data Protection Regulation (GDPR).
GDPR is a EU regulation that concerns data privacy and security in the European Union and the European Economic Area.
GDPR is an EU regulation that concerns data privacy and security in the European Union and the European Economic Area.

By attesting that Appwrite is GDPR compliant, we have done the following:
- Appwrite users will retain access to their personal information including the right to correct and to delete it.
By attesting that Appwrite is GDPR compliant, we have done the following.
- Appwrite users will retain access to their personal information including the right to correct and delete it.
- Impose the same rules upon the organization's sub-processors who assist in providing Appwrite's services as described in the Terms of Service (“ToS”).
- Appwrite will notify users promptly about policy changes and/or data breaches.

Expand All @@ -26,7 +26,7 @@ Appwrite has also implemented the following security measures to achieve technic
A DPA, or Data Processing Agreement, is a contract between a data controller and data processor concerning the rights and obligations
of both parties when processing personal data.

This agreement describes how Appwrite and sub-processors handles, secure, transfers data, as well as outline rights and obligations of both Appwrite and
This agreement describes how Appwrite and sub-processors handle, secure, and transfer data, as well as outline rights and obligations of both Appwrite and
you or your company when personal data is processed.

You can find and sign a DPA in your organization's **Settings** > **Download DPA document**.
Expand Down
2 changes: 1 addition & 1 deletion src/routes/docs/advanced/security/pci/+page.markdoc
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ layout: article
title: PCI
description: Learn about Appwrite's measure to achieve PCI compliance when handling payments and transactions, ensuring secure and safe handling of payment information and personal data.
---
The Payment Card Industry Data Security Standard (PCI) is a standard that concerns handling of credit card information, transactions, and payments.
The Payment Card Industry Data Security Standard (PCI) is a standard that concerns the handling of credit card information, transactions, and payments.
Appwrite uses [Stripe](https://stripe.com/en-se) to securely handle payments for Appwrite Pro and Scale plans.
Stripe is a [PCI Service Provider Level 1](https://www.visa.com/splisting/searchGrsp.do?companyNameCriteria=stripe) provider
with a strong [commitment to security and privacy](https://stripe.com/docs/security) that matches Appwrite's core values.
Expand Down