Security Overview.
TruepixID is built on a simple principle: Verified, Not Stored™. We generate portable proof for photos and short videos while minimizing the data we hold and the time we hold it. Security is layered, auditable, and privacy-first by design.
Encryption
TLS (HTTPS) for all client↔server communications. No unencrypted channels.
Server-side encryption with AWS KMS (SSE-KMS) for verified artifacts and metadata.
Scoped KMS keys with least-privilege grants and rotation policies.
Application secrets stored in AWS Secrets Manager / environment vaults — never hard-coded in source.
Regional Data Residency
Choose where your verification artifacts reside. Buckets, keys, and lifecycle policies are isolated per region to keep sovereignty simple and auditable.
- Region-specific S3 buckets and KMS keys
- No cross-region replication for verification artifacts
- Service endpoints constrained to the selected residency
Short Retention & Deletion Receipts
We keep only the stamped artifact — not the original — and only for a short, transparent period. Lifecycle rules enforce automatic deletion at expiry.
- Automated lifecycle delete jobs with audit logs
- Deletion receipts include UTC time and file hash
Platform Security
Network
Private VPC, security groups, and restricted egress for internal services.
Access Control
IAM least-privilege, role-based access, and scoped service roles.
Edge Protection
WAF rules, rate limiting, and abuse detection for uploads and verification sessions.
Auditability
Structured logs for verification, deletion, and admin actions with alerting on anomalies.
Build Pipeline
Dependency pinning and provenance checks as part of CI.
Privacy by Design
- No storage of originals — ever
- Strict minimization of metadata (only what's needed for proof)
- Clear user controls and receipts for deletion
- Plain-language policies — see Privacy Policy
Compliance & Standards
We align with modern privacy frameworks and security best practices. Formal certifications vary by plan and deployment — contact us for current scope.
PIPEDA
Privacy principles aligned with Canadian federal law.
CPRA
Consumer privacy rights and data minimization practices.
GDPR
Privacy-by-design principles aligned with EU regulation.
- Encryption and key management aligned with AWS best practices
- Data residency controls (US / Canada) and documented lifecycle deletion
Responsible Disclosure
We appreciate reports from the security community. If you believe you've discovered a vulnerability, please reach out privately so we can investigate and remediate quickly.
Contact
Questions about how we protect your data?