Security

Here’s how your Tutu account is protected.

Argon2 with a random salt

Passwords are hashed with Argon2 and a per-account random salt, so even a database leak can’t reveal them. We never see your password.

PKCE S256 enforced

Third-party sign-in uses the OAuth2 authorization code + PKCE (S256 enforced, plain rejected). Codes are single-use and valid for 60 seconds with binding checks, preventing interception and replay.

One-click sign-out everywhere

After a password change or “sign out of all devices”, tokens are checked against the issue time — old sessions expire instantly, no waiting.

Account-takeover defense

Products link only by a unique account ID, never merging existing accounts by an unverified email. This closes off “register with your email to take over” at the root.

What you control

Security isn’t only on us — these tools are always in your hands.

View security activity

The account center shows recent sign-ins, password changes, authorizations and more — anomalies at a glance.

Manage devices

In “Devices & sessions”, revoke signed-in devices and products one by one or in bulk.

Revoke app access

Don’t want a product using your Tutu account anymore? Revoke in one click; it must re-authorize next time.

Data retention & deletion

After deletion your account is invalidated immediately and signed out everywhere; data is soft-deleted and kept for 30 days (in case of mistakes), then hard-deleted automatically with cascading cleanup of sessions, authorization codes, grants and security logs. To learn how we collect and use information, see the Privacy Policy and Terms of Service.