Security
How Joinpane keeps a shared sign-in, and what it promises about it. The whole story, with who sees what and how long we keep things, is on the Security page.
How sessions are kept
An identity is one long-lived browser holding one signed-in session: the cookies and stored data that keep it signed in to the website. That session is what's worth protecting.
- Encrypted at rest. In Joinpane cloud the session is stored encrypted between uses, with a key for that identity alone.
- Decrypted only on the machine running the identity, when it wakes. It sleeps after 15 minutes with nobody inside.
- On a custom node, only on the node. Its sessions stay on its own disk and Joinpane keeps no copy. While an identity moves on or off a node, its session travels sealed with the identity's key, and the copy in transit is deleted once it arrives.
- Windows stream from that browser to each person. Joinpane passes the stream along without reading it; cookies never leave the browser.
- Passwords are never stored. A password goes from the keyboard of the person signing in to the website. The browser doesn't save it, and nobody can read one back.
- Sign everyone out, in an identity's settings, closes every window and forgets the session. Its key changes too, so no earlier copy can be read.
What Joinpane promises
These hold everywhere, and we test for each of them.
- Websites never see a new device. An identity keeps one browser for life: its user agent, screen size and input type never change, and moving your window to a phone changes only the window's size. Its address changes only when an admin changes its IP or moves it onto or off a node, and the app warns first.
- A person solves every human check. Joinpane never solves CAPTCHAs, and never gets around a website's security.
- Agents never get cookies or passwords. They can't type into password fields unless an admin allows it, and they ask a person before publishing or paying.
- Sessions never leave the machine unencrypted. No window can reach the browser's developer tools, its internal pages, javascript: addresses, extension installs or the profile's files. A custom node's sessions stay on it, except while an identity moves.
- Unshared windows stay private. Their pages, not even their titles, are never shown to anyone else.
- Removing someone closes their windows within 5 seconds. They never had the password, so there's nothing to change at the website.
- The audit log is append-only. Nobody can change or delete an entry, admins included.
- Addresses are described by what they are. An IP shows its tier, its kind and its place. The networks and machines behind Joinpane are ours to run, and the product never names them.
Agents
Agents get capabilities, not secrets. An agent reads pages as text and presses buttons in a window of its own, labelled as an agent, which anyone with access can watch and take over. It gets the page and a screenshot, never the session; when it asks a person, the people asked see a screenshot of its window.
Keys, limits and what an agent may do are in Connect an agent.
Custom nodes
A node keeps its identities' sessions on your machine, and only calls out. It also trusts whoever runs that machine: anyone with administrator access to it can get around a window's lockdowns and read the sessions it holds. Run nodes on machines you control. See What a node holds.
On the Security page
Reporting a problem
If you find a security problem in Joinpane, email security@joinpane.com with what you found and how to reproduce it. We confirm within 2 working days. Test against a workspace of your own; the Free plan is enough. The rules are under Reporting a vulnerability.