Sign-in and upload safety
What Rokn checks when you sign in, set a password or upload a file.
Passwords
Rokn refuses a password that has appeared in a known data breach, wherever one is set: sign-up, reset and change. Only the first few characters of a one-way fingerprint of the password leave Rokn for the check, never the password itself.
A new browser
When you sign in with a password from a browser Rokn does not know, it emails you a 6-digit code to finish signing in. Remember this device for 30 days is a visible checkbox, ticked by default. If you use an authenticator app, you keep that step instead of the emailed code.
A human check
Sign-up and password reset ask you to confirm you are human. Signing in asks only after repeated failed attempts, and never locks the account.
Uploaded files are scanned
Files you upload are checked for viruses before anyone else can open them. Until then only the uploader can, and the file shows Checking for viruses. A file with malware is deleted, and its uploader and the admins are told. If a file cannot be checked, only its uploader can open it and nothing is deleted automatically: owners and admins review such files in Settings → Storage and delete the ones they do not trust.