Many security-conscious product companies go through an independent audit of their security processes to become certified. This doesn't necessarily mean that th

Many security-conscious product companies go through an independent audit of their security processes to become certified. This doesn't necessarily mean that the code is secure, but it does mean that the company/product follows procedures and policies designed to ensure that the company and its products are secure, such as going through an annual penetration test. According to their website Authy is SOC2 compliant, so you should be able to ask them for their report (you typically have to sign a NDA). Importantly, you should read the report, ESPECIALLY the exceptions. It should give you a good feel for their security model and security defenses.