Security
Sign-in with passkeys, no passwords
Ambery accounts use passkeys only. A passkey is stored on your device or in your password manager (for example iCloud Keychain or Google Password Manager) and is unlocked with your fingerprint, face or device PIN. We store only its public key, which cannot be used to sign in on its own. We never store passwords, because there are none.
Verified email
When you sign up, we email you a 6-digit code to prove the address is yours. Codes are single use, expire after 10 minutes (15 for recovery), allow only a few attempts, and are stored only as a keyed hash.
Recovery
If you lose your passkeys, you can recover your account with a code sent to your email address. We recommend adding a passkey on a second device ("Add another device" on your account page). Our support team cannot restore access by email, because an email to us cannot prove who you are.
Sessions
Your sign-in is kept in a secure, HTTP-only cookie for up to 30 days. We store only a hash of the session token. Deleting your account or adding a passkey requires you to have signed in with your passkey within the last 5 minutes.
What we never store
Passwords, your passkey private keys, fingerprints or face data, plain email codes, or session tokens. No card details: payments are not offered during the beta.
Other protections
HTTPS only; limits on sign-in and email requests; the same reply whether or not an email address has an account; and an automated security review of every release.
Reporting a vulnerability
Email support@amberyeducation.com with "Security" in the subject, and include the steps to reproduce. Please don't access other people's data, disrupt the service or run automated scans, and give us reasonable time to fix the issue before disclosing it. We will acknowledge your report and keep you updated. We cannot pay rewards during the beta.