Security at Fob
Fob holds the keys to everything else you run. This is how it protects them, and what stays in your hands.
A stolen password isn't enough
Passkeys are on by default and can't be phished. You can require one, or a second factor, on any app. Passwords still in use are checked against known breaches, and repeated wrong tries lock the account.
Nothing stays open for long
SSH certificates expire in hours, 8 by default. Access on request ends when its time runs out. Disable someone, or take them out of a group, and their open connections through Fob end within 30 seconds.
Your organization stands alone
Each organization has its own directory, its own signing keys and its own SSH certificate authority. Sign-in pages are served from a separate domain to the console.
Secrets are encrypted, or not kept
Signing keys, SSH CA keys and authenticator secrets are encrypted at rest. Client secrets and API keys are shown once, and API keys are stored as hashes.
You can see what happened
The sign-in log and the audit log are kept for 365 days, and the audit log exports as CSV or JSON Lines. Terminal sessions through Fob are recorded off the server, so nobody who connected can edit the recording.
Built on open standards
OpenID Connect, SAML, SCIM, WebAuthn and OpenSSH certificates. Nothing needs a Fob SDK, so nothing you connect is locked to Fob.
Security reviews
Send your questionnaire to hello@fob.so and the people who built Fob will answer it. Fob hasn't been through a SOC 2 or ISO 27001 audit yet.
Report a vulnerability
Email hello@fob.so with the details and how to reproduce it. Please give us time to fix it before telling anyone else.
Give everyone their own key.
Single sign-on, passkeys and logs are on the free plan. Tell us about your team and we'll get you started.