Service boundaries

Security

Last updated: 16 August 2026

SetupPasskeys is a guidance service. The planned paid offer is a hosted, branded employee guide built around routes an organisation’s IT team explicitly approves. Enquiries are open; paid orders are not yet available. It is not an identity provider, policy-enforcement system or tenant-management application.

Free and public routes do not connect

The free and public experience does not connect to a customer tenant or Microsoft Graph. The homepage, generic setup guide, public branding preview and enquiry do not sign in, request Microsoft Graph consent, install an enterprise application, read passkey profiles or make a hidden sign-in request. The standard hosted guide can also run from a manually approved route matrix without an employee account or tenant connection.

Do not send passwords, passkeys, PINs, Temporary Access Pass values, recovery codes, authentication tokens, live enrolment QR codes or confidential incident evidence. They are not needed to prepare or use a guide.

Optional connection for an ordered organisation guide

A paying organisation may separately order connected personalisation. An authorised IT administrator must first approve the stated Microsoft application permissions for that tenant. The connection reads the tenant’s Passkey (FIDO2) profile configuration. Opening an identity-enabled direct guide can make one non-interactive Microsoft session check. When Microsoft can satisfy that check—or the employee separately chooses the explicit sign-in action—the service uses the immutable Microsoft tenant and user identifiers (tid and oid) to bind that session to the correct customer.

The server asks Microsoft Graph whether the signed-in user matches only the target groups referenced by the approved passkey profiles. It receives a match result, not a directory or group list for display. It can also read a reduced view of passkeys registered to that work account: passkey type and count. The browser receives the resulting status and allow-listed guide routes, not group identifiers, credential identifiers, authenticator model or AAGUID metadata, raw Graph responses or Microsoft access and refresh tokens.

Microsoft tokens are kept in an encrypted server-side session and represented in the browser by an opaque, secure, HTTP-only session cookie. Authorisation transactions are short-lived and one-use. Sessions expire, are removed on sign-out, and are invalidated when the organisation disconnects or Microsoft consent is revoked. Policy and account-data failures fail closed to the public branded or generic guidance instead of widening the allowed route set.

Administrator consent does not prove that an employee already has a Microsoft browser session and does not guarantee silent SSO. A valid SetupPasskeys session can personalise immediately. Otherwise an eligible direct guide makes at most one non-interactive attempt while the branded guide remains available. A silent attempt that needs interaction stops and leaves an explicit Microsoft sign-in button; it does not automatically open an interactive login or loop.

The connection is read-only. It cannot receive or use a passkey private key, register or delete a passkey, change a profile, or enforce tenant policy. Registered-method data proves only that a method is associated with the work account. It does not prove that the passkey is available on the phone or computer currently viewing the guide. The service does not evaluate Conditional Access, authentication strengths, device compliance, risk, licensing or every other control that may affect registration or sign-in.

IT-approved routes are configured explicitly

For a customer deployment, SetupPasskeys manually configures a route matrix for the agreed audience. That matrix identifies the approved passkey methods and the device, platform, software-version and sign-in combinations for which instructions may be shown. The hosted experience filters the guide to those routes; a missing or invalid hosted policy fails closed instead of substituting the public guide.

This is a presentation control, not automatic policy enforcement. The customer must confirm that the supplied route matrix matches its current tenant configuration and must approve the guide before employee use. A public branding preview changes only the visual identity; it cannot read Entra policy, identify a visitor’s assigned group or create an approved policy. SetupPasskeys controls which instructions employees see; it does not change the native provider picker or enforce tenant policy. Microsoft Entra evaluates the profiles IT configures. When attestation is off, provider and AAGUID choices are employee guidance rather than verified device identity.

Cross-device QR registration or sign-in is included only when the customer confirms and tests that route. Microsoft Entra blocks cross-device Authenticator flows when passkey attestation is required, so an unconfirmed hosted matrix must omit that sign-in mode.

What the browser keeps

Device, method and guide-step choices are kept in session storage so a visitor can continue in the same browser session and are reflected in the SetupPasskeys page URL for browser history and shareable guide links. A public branding preview also keeps only sanitised branding and the organisation domain in session storage for that tab. These records are not passkeys or authentication credentials and are not sent to the customer’s tenant.

A connected paid-org guide uses a separate HTTP-only session cookie. Personalised account status, Microsoft tokens and group/profile identifiers are not written to the guide URL, local storage or session storage.

Preview and enquiry boundary

Entering a public company domain for a branding preview does not create an enquiry or sales lead. A commercial record is created only when someone separately submits an enquiry form or starts the legacy purchase flow. Enquiries are validated and stored in a service-role-only database table before a best-effort founder notification is attempted. Delivery state remains visible in the private admin if the email notification is delayed or fails.

Service and admin controls

Public form submissions are size-limited, same-site checked, validated, rate-limited using short-lived keyed hashes and made idempotent when the browser supplies a submission ID. The private admin uses Supabase authentication plus a server-side email allowlist. Service-role and email-provider credentials remain server-side and are not sent to the browser.

Connected employee access uses an authorisation-code flow with PKCE, transaction-specific state and nonce values, exact redirect destinations and server-side token exchange. Tenant and user authorisation uses validated tid and oid claims rather than an email domain. The Microsoft connection requests read permissions only; it does not request policy-write or authentication-method-write permissions.

Legacy Rollout Kit

The unlinked, noindex Rollout Kit is a separate legacy one-time document product; it is not the hosted branded-guide service. Its unpaid document previews are watermarked. If checkout is enabled after the legal launch gates are complete, Stripe hosts card entry and the server verifies payment before unlocking downloads. Private edit links are high-entropy capability credentials; recovery requires both the code and purchase email and only resends the link to the address held for that order.

Public-source discovery

Private sales tooling can be asked to discover business contact details from an organisation’s public website. It is restricted to the submitted public domain, honours robots.txt, blocks private-network and cross-domain requests, ignores login pages and considers only addresses published in public page content.

Report an issue

Please report suspected vulnerabilities privately to security@setuppasskeys.com.