Shareholder & stakeholder update

How a login actually happens — and what changed this quarter

This page walks through the real protocol behind every Access Glow login, in plain language, alongside the measured results of a performance review completed this quarter. Nothing here is simplified into fiction — these are the actual standards and the actual numbers.

The login flow

Six steps, roughly two seconds end to end. Three parties are involved: the website a customer is logging into, the Access Glow service, and the customer's own phone.

Website
1
Site requests a session
The website identifies itself with a cryptographic site key — never a password.
HTTPS · HMAC-SHA256
Access Glow
2
One-time pattern issued
A unique visual pattern and a short-lived session token are returned — nothing permanent.
single-use token
Phone
3
App scans the pattern
The customer points their phone's camera at the screen. Recognition is instant.
HTTPS / TLS
Phone
4
Face / Touch ID confirms
Checked entirely inside the phone's secure hardware. Biometric data never leaves the device.
on-device only
Phone
5
Device signs a challenge
Cryptographic proof that this exact device, and this person, approved the login.
ECDSA · P-256 · SHA-256
Access Glow
6
Signature verified — signed in
The website completes the login through WordPress's own native process, so every other security check installed on the site still applies.
verified ✓

Why this holds up

Three properties of the design that reduce the risk categories most password breaches come from.

What changed this quarter

Results from controlled capacity tests against the live production service, comparing before and after a series of security and performance improvements completed this quarter. Figures are measured against real infrastructure, not projected.

Concurrent logins handled with zero errorswas <1001,100↑ 11×, full real login flow, 100% success
Time to verify a site's identitywas 371 ms19ms↓ 19× faster
Requests that stalled under peak loadwas 80% of traffic0%stalls eliminated
Passwords stored for this login method0alwaysby design, not policy
Access Glow's security model is built around cryptographically secure tokens, device-bound signatures, and biometric verification performed entirely on-device. This quarter's optimization work removed a capacity bottleneck without changing that model — the same standards shown above now run substantially faster under real-world load.