Security

Encryption in transit

TLS 1.3 on all connections.

Encryption at rest

Biometric artifacts (selfies, documents) are stored with server-side encryption.

Private storage

Images live in non-public buckets. They are only accessible through authenticated and audited backoffice endpoints.

Origin allowlisting

Your public_token only works from domains you explicitly authorize. Embeds from unauthorized origins are rejected.

HMAC signing

Each client has an independent webhook_secret. All webhooks are signed with HMAC-SHA256 so you can verify authenticity. The secret is rotatable at any time.

Tenant isolation

Data is stored isolated per account. You cannot see other clients' verifications and vice versa.

Data minimization

Your metadata passes intact. Trusty does not interpret or modify it.

2FA

The backoffice supports two-factor authentication (TOTP) for all users.