Security for domain-first authentication.
Reduce attack surface with verified domains, scoped OAuth, and transactional-only email.
Our security approach
Domain identity first
Authentication flows and transactional email operate under the same verified domain, making legitimate communication easier to recognize.
Restricted scope
AccountMaker limits functionality to authentication and identity-related communication. This reduces misuse and abuse vectors.
Explicit behavior
Security-relevant actions are intentional, auditable, and bounded. Nothing is hidden behind opaque automation.
Threats we design against
AccountMaker is built with common SaaS security and abuse scenarios in mind.
Phishing and impersonation
Users are tricked by emails or login pages that appear legitimate but are not.
Domain confusion
Authentication and email originate from different domains, weakening trust signals.
Email abuse
Infrastructure intended for identity communication is repurposed for spam or scams.
Silent misconfiguration
Incorrect DNS, email, or auth settings fail quietly and create security gaps.
How AccountMaker reduces risk
Verified domain enforcement
Authentication and email require domain verification. Shared or provider-owned domains are not used for customer-facing flows.
Transactional-only email
Email sending is limited to identity and operational use cases. Marketing and bulk campaigns are not supported.
Inbound email hardening
Inbound messages to identity-related addresses are filtered aggressively, stripped of attachments, and stored as plain content.
Consistent identity surface
Users interact with a single, predictable domain for login and security communication.
Who this security model is designed for
For
- SaaS products with real users
- B2B platforms requiring strong security
- Predictable, explainable authentication
Also for
- Internal tools and MVPs
- Solo-built projects
- Limited-run products
Transparency over promises
AccountMaker avoids vague security claims. Instead, it reduces risk by narrowing scope, enforcing domain identity, and keeping authentication and communication aligned.
- Clear boundaries reduce misuse
- Consistency improves user trust
- Restricted capabilities limit abuse
Security through clarity
AccountMaker focuses on doing fewer things, more predictably, under your domain.