A layered security model
Seppuwa.com uses multiple account and application controls rather than relying on one security feature. The goal is to protect normal sign-in, document ownership, temporary sharing and account recovery while keeping important actions visible to the user.
Account verification and passwords
Email verification is used to confirm access to an account email address. Passwords should be unique, difficult to guess and kept private. Verification codes are temporary credentials: do not forward them to another person or enter them on a site you did not intentionally open.
Sessions and device review
Signed-in sessions identify authorized browser sessions. Security Center can surface active devices and login history so you can recognize unfamiliar access. Supported sessions can be ended remotely, and security-sensitive changes can invalidate or restrict existing sessions.
Document ownership checks
Private file access is tied to the authenticated account and server-side ownership checks. Preview or download access should be granted only after the service confirms the current session has permission for the requested item. Public sharing uses a separate controlled-link workflow rather than making the private dashboard itself public.
Controlled sharing
Share links are designed for intentional temporary access. Use an expiry appropriate to the recipient, add a password for sensitive documents and revoke links that are no longer needed. A valid sharing link is itself sensitive information, so avoid posting it publicly or forwarding it to unintended recipients.
Security activity and notifications
Recent account actions and status messages help users notice changes such as new sign-ins, sharing activity, security setting changes and other account events. Activity history is a practical user-security feature, not a substitute for a formal regulatory audit system.
Optional location information
Location permission can be used to add context to login history. Seppuwa.com explains the purpose before triggering the browser permission request, and users can decline. The browser or device remains responsible for granting or denying precise location access.
Camera, face verification and liveness
Camera access is requested only for workflows that need it, including document scanning and optional face-verification features. Emergency Face Login can use live face challenges and a separate Emergency PIN. These controls are designed to make certain recovery scenarios harder to abuse, but they should not be treated as permission to share passwords, PINs or biometric data.
Security practices for users
- Use a unique password and protect the email account used for verification.
- Do not share passwords, OTP codes or Emergency PINs with support staff or other people.
- Review active sessions and unfamiliar login activity.
- Keep browsers and operating systems updated.
- Use short share-link expiries and revoke access when finished.
- Avoid uploading unlawful content or files you do not have permission to store.
- Keep an independent backup of irreplaceable documents.
Reporting a security concern
If you notice unexpected account behavior, first secure your account by changing your password and reviewing sessions. Then use the Contact page to report the issue with a description, approximate time and affected feature. Never attach secret credentials, OTP codes, Emergency PINs or biometric material to the support request.