Shared responsibility

We secure the platform, infrastructure, and isolation boundaries. Your organization secures its accounts, keys, signer policies, and the access it grants to its own workspace. Strong outcomes depend on both.

Encryption

Data is encrypted in transit with TLS and at rest with AES-256. Sensitive material is protected with per-workspace keys so that one tenant's data is cryptographically separated from another's.

Tenant isolation

Each client is a fully isolated workspace boundary. Application, data, and access layers enforce that boundary so that records, documents, and verification evidence never cross between tenants.

Access control

• RBAC: role-based access with permission-aware redaction, so each user sees only the records their permissions allow.
• Just-in-time elevation: privileged access is time-boxed and logged.
• Least privilege: internal access to production is restricted and reviewed.

Audit & integrity

Sensitive actions are written to an append-only, hash-chained audit log that is tamper-evident. Citations and answers from the intelligence layer are traceable to the underlying records, and never expose anything beyond a user's permissions.

Resilience

We maintain encrypted backups with point-in-time recovery while preserving tenant isolation. Infrastructure is monitored continuously for availability and anomalous activity.

Verification partners

Identity verification and screening are delivered through vetted, industry-leading providers under strict data-protection terms. Deciphr is the operational layer where verification, approvals, payments, and financial records converge.

Compliance program

Our controls are aligned to recognized frameworks, with a SOC 2 Type I assessment in progress. We align our data handling to GDPR and POPIA.

Incident response

We maintain an incident-response process covering detection, containment, eradication, and recovery. Where required by law or contract, we notify affected customers and authorities without undue delay.

Reporting a vulnerability

If you believe you have found a security issue, please report it through the contact form below. We welcome responsible disclosure and will work with you to validate and remediate verified reports.