What data is stored when I link a provider?
When you authorize Google, LinkedIn, or Microsoft, OpenStudio stores only the minimum data needed to recognize you on future sign-ins:
- Provider ID — an opaque numeric identifier issued by the provider (e.g., your Google User ID). OpenStudio never stores your Google password.
- Display name — the full name from your provider profile, shown on your Connected Accounts card for your reference.
- Email address — used to verify the link matches your OpenStudio account.
OpenStudio does not request or store access to your emails, calendar, files, contacts, or any other provider data.
What data is stored for a passkey?
The WebAuthn (FIDO2) standard is designed so that no biometric data ever leaves your device. What is stored in OpenStudio's database is:
- A public key — mathematically paired with a private key that exists only on your device's secure enclave. The public key alone is useless to an attacker.
- A sign count — a counter incremented on every use, allowing the system to detect cloned authenticators.
- Your device name and User-Agent string — for display purposes on the Connected Accounts page.
Privacy guarantee: Your fingerprint, face scan, and PIN never leave your device.
OpenStudio only ever sees the cryptographic proof that the correct device was present.
OpenStudio only ever sees the cryptographic proof that the correct device was present.
Best practices
- Link multiple providers. Having two or three sign-in methods means you are never locked out if one provider has an outage.
- Remove passkeys for old devices. If you trade in or sell a device, remove its passkey from Connected Accounts before the handover.
- Review linked accounts periodically. Check the Connected Accounts page from time to time to ensure only providers you recognize are listed.
- Do not share devices. Passkeys are registered per-device. If a colleague uses your machine and you have a passkey registered, they will be prompted for your biometrics at login — they cannot proceed without them.
What happens if I lose access to a linked provider?
If your Google or Microsoft account is suspended or you lose access to it, you will no longer be able to use that provider button on the login page. However, you can still sign in with:
- Any other linked provider (LinkedIn, Microsoft, passkey).
- Your OpenStudio username and password.
Once signed in, go to Connected Accounts and unlink the inaccessible provider, then re-link a new one.
