Security is part of the product, not a checkbox.
The controls running today — and, just as plainly, what we do not have yet.
Every request has to earn its answer.
What is implemented
Signed requests
HMAC-SHA256 over method, path, body, timestamp and nonce. Secrets are shown once at creation.
Replay protection
±5-minute timestamp window and single-use nonces that survive restarts.
Scoped keys & roles
Per-capability API key scopes; dashboard roles, TOTP MFA, idle session timeout and login throttling.
Encryption at rest
AES-256-GCM for API secrets, lookup cache, MFA secrets and retry results. Session IDs stored hashed.
Encrypted backups
Automatic AES-256-GCM snapshots of the data store at startup and every 24 hours, retained 14 days, written owner-only on the server.
Data minimisation
Images are never stored; NIK is masked in records; logs contain no images or OCR values.
Isolated inference
The biometric service is private and rejects any request without an internal service token.
Key-level network & spend controls
Optional IP allowlist per API key, and a monthly spend limit that stops billable calls before they run.
Customer-controlled retention
Choose how long analysis details are kept (30 days to 5 years); redact any analysis on request through the API.
Audited governance
Policy, blocklist, key-limit and settings changes are recorded in the audit log with before and after values.
What we do not have yet
Listed so your security team can assess us on accurate information.
- CertificationNot currently certified (ISO 27001, SOC 2 or similar).
- Third-party penetration testNot yet performed.
- Published SLA & incident processNot yet published; discussed in enterprise agreements.
- SSO (SAML / OIDC)Not yet available.
- Deepfake & injection-attack detectionNot yet available. Passive liveness targets printed and on-screen presentation attacks.
Running a security review?
Our team answers security questionnaires for enterprise procurement.