Usalama na Uaminifu

Compliance & certification status

We distinguish between implemented controls, frameworks we are aligned with, and certifications we are working toward.

🛡️

SOC 2 Type II

Readiness in progress (2026)

🔒

ISO 27001

Readiness in progress (2026)

🇪🇺

GDPR

Aligned data processing

🔐

Pen Test

Annual cadence planned

Implemented today

AES-256-GCM encryption at rest, per-applicant keys
TLS 1.3, HSTS, strict CSP and security headers
HMAC-SHA256 request signing with replay protection
TOTP 2FA for admin accounts
Immutable audit logging
GDPR-aligned data retention & erasure workflow

Readiness in progress

SOC 2 Type II audit preparation (target 2026)
ISO 27001 certification preparation (target 2026)
External penetration test cadence
Formal business continuity testing

Actual certifications

No third-party certifications are currently in force. When certificates are issued, copies and reports will be linked here. Reach out to security@trustverifyid.com for our latest evidence pack.

Infrastructure Security

🇪🇺

EU Data Residency

All production data stored on servers located within the European Union. We do not transfer personal data to third countries except under SCCs (e.g., Stripe, SendGrid).

🔒

AES-256-GCM Encryption

Every identity document and biometric file is encrypted at rest using AES-256-GCM with a unique per-applicant encryption key. Master keys are stored in environment variables, never in the database.

🌐

TLS 1.3 in Transit

All API and dashboard traffic is protected by TLS 1.3. HTTP Strict Transport Security (HSTS) enforced with a 1-year max-age. All HTTP requests redirect to HTTPS.

⚡

DDoS & Rate Limiting

API rate limiting via Redis (100 req/min per key by default, configurable). DDoS mitigation at network edge.

🛡️

Upload Validation

Strict MIME-type and magic-byte validation on every uploaded file, with size limits enforced before processing. Malware scanning is applied where the scanning engine is enabled.

📝

Content Security Policy

Strict CSP headers on all dashboard pages. X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers set on all responses.

Access Control & Authentication

🔑

API Key + HMAC

Every API request must carry X-API-Key, X-Signature (HMAC-SHA256), and X-Timestamp. Requests older than 5 minutes are rejected.

📱

TOTP 2FA

TOTP two-factor authentication required for all admin accounts. Backup codes stored as bcrypt hashes.

👥

Role-Based Access

Three admin roles: reviewer, admin, super_admin. API keys scoped to environments (live / sandbox).

📋

Immutable Audit Log

Every data access and modification is logged with actor ID, IP, user-agent, and timestamp. Logs cannot be deleted.

Request Signature Scheme

Every API request is signed to prevent replay attacks and request tampering.

// HMAC-SHA256 signature construction

payload = timestamp + "\n" + METHOD + "\n" + path + "\n" + sha256(body)

signature = hmac_sha256(payload, rawApiKey)

// Request headers

X-API-Key: ak_live_...

X-Signature: {signature_hex}

X-Timestamp: 1708700400 // Unix epoch — reject if > 5 min old

🔎

Responsible Disclosure Policy

If you discover a security vulnerability in TrustVerifyID, please email us at security@trustverifyid.com. We will acknowledge within 24 hours and aim to resolve critical issues within 72 hours. We ask that you do not publicly disclose the issue until we have had a reasonable time to respond.

24h acknowledgement 72h critical fix target No legal action for good-faith disclosure Hall of fame for credited reporters