Security

N4XION AI is built to keep your account simple and safe. There are no passwords to steal, provider keys stay on the server, and your session is protected. This page explains how that works and how to report a problem.

Sign in without a password

You do not create or store a password. When you sign in, we send a six digit code to your email. You enter that code to prove the email is yours. Because there is no password, there is nothing to reuse across sites and nothing for an attacker to guess or leak.

Codes and sessions are hashed

We do not store your login code in plain form. We store a hash of it, so even someone with database access cannot read the code you were sent. The code is short lived and works once. Your session is handled the same way. We store a hashed session value rather than a token that could be read and replayed.

HttpOnly cookies

Your session lives in an HttpOnly cookie. Browser scripts cannot read it, which helps protect your session if a page ever runs code it should not. The cookie keeps you signed in between visits until it expires or you sign out.

Provider keys stay on the server

OPAW talks to AI providers using API keys. Those keys are kept as server secrets. They are never sent to your browser and never appear in a response. Your requests reach a provider through our server, so your browser never holds a provider key.

Report a problem

If you find a security issue or something looks wrong with your account, tell us. Email hello@n4xion.net with what you saw and how to reproduce it. Please do not post the details in public while we look into it.