Security at Domain Collective

Authentication and sessions

Authentication cookies are HttpOnly and SameSite=Lax, become Secure in production, and are limited to trusted origins. Signup, login, OAuth callback, and sensitive verification paths enforce rate limits.

Signed-in users can review recent active sessions, connected sign-in accounts, and step-up verification state in Security Settings.

Domain authorization

Domain access is deny-by-default and resolved from personal ownership, organization roles, or explicit domain collaborators. High- and critical-risk changes require recent email step-up verification. Ownership transfer requires a second person, and self-approval is blocked.

Registrar credential handling

Domain Collective does not ask for your registrar password. You create a separate API credential at the registrar and can revoke it there at any time.

Credentials are validated before a connection is stored. Each value is encrypted with AES-256-GCM before database storage and is decrypted by backend services only when a supported registrar call requires it. Raw and encrypted credential values are removed from integration API responses.

Registrar mutation records

Supported registrar mutations create an intent record before the external API call and a correlated result record afterward. Secret-like fields are redacted from persisted audit payloads.

What remains under your control

• Protect the email inbox and devices used to sign in.
• Domains remain registered with their existing providers.
• The registrar remains the authority for credential scopes, rotation, and revocation.
• Changes performed directly at the registrar do not pass through Domain Collective's authorization flow.
• You control workspace membership and domain collaborator roles.

If a credential may be exposed, revoke it at the registrar first.

Account data

Security Settings provides recent session visibility, account-data export, and permanent account deletion. Exports omit stored registrar credentials.

Responsible disclosure

Report security concerns to security@collective.domains. Include the affected surface, reproduction steps, and potential impact. Do not access another customer's data or disrupt service while validating a report.

Service availability notices are published on the status page.