Sign in & provisioning

#Sign in with Cloudflare

There are no sSystm credentials. You authenticate with an OAuth grant against your own Cloudflare account — one button, one consent screen. The session handoff uses a short-lived one-time code (2 minutes, single use) so sign-in works even under Chrome’s bounce-tracking protection.

The grant asks for a set of fine-grained Cloudflare scopes (D1, Workers scripts, DNS, analytics and more) — the full table with risk levels is in Cloudflare integration. The token is stored encrypted (AES-256-GCM) and is only ever decrypted server-side to act on your account.

#What gets provisioned

The moment your grant lands, sSystm creates a dedicated D1 database on your account with a deterministic name (sstm-<org-id>) and runs the core schema migrations into it. If the database already exists — say you reconnect later — it is re-attached, never recreated, so your data survives a lost connection.

• Region choice. You pick where the database lives during sign-in. Choosing the EU creates it with a hard EU jurisdiction guarantee, enforced by Cloudflare at the infrastructure level; other regions use location hints.
• Revocation. Revoke the grant in your Cloudflare dashboard and sSystm is locked out. The database — and your data — stays on your account.