Security Overview.
TruepixID is built on a simple principle: Verified, Not Stored™. We generate receipt-backed Integrity Records for photos and short videos while minimizing the data we hold and the time we hold it. Security is layered, auditable, and privacy-first by design.
Encryption
TLS (HTTPS) for all client↔server communications. No unencrypted channels.
Server-side encryption with AWS KMS (SSE-KMS) for integrity-recorded artifacts and metadata.
Scoped KMS keys with least-privilege grants and rotation policies.
Application secrets stored in AWS Secrets Manager / environment vaults — never hard-coded in source.
Regional Data Residency
Choose where your integrity-recorded artifacts reside. Buckets, keys, and lifecycle policies are isolated per region to keep sovereignty simple and auditable.
- Region-specific S3 buckets and KMS keys
- No cross-region replication for integrity-recorded artifacts
- Service endpoints constrained to the selected residency
Short Retention & Deletion Receipts
We keep only the processed artifact — not the original — and only for a short, transparent period. Lifecycle rules enforce automatic deletion at expiry.
- Automated lifecycle delete jobs with audit logs
- Deletion receipts include UTC time and file hash
Platform Security
Network
Private VPC, security groups, and restricted egress for internal services.
Access Control
IAM least-privilege, role-based access, and scoped service roles.
Edge Protection
WAF rules, rate limiting, and abuse detection for uploads and Integrity Record sessions.
Auditability
Structured logs for Integrity Record processing, deletion, and admin actions with alerting on anomalies.
Build Pipeline
Dependency pinning and provenance checks as part of CI.
Privacy by Design
- No permanent storage of originals
- Strict minimization of metadata (only what's needed for integrity records)
- Clear user controls and receipts for deletion
- Plain-language policies — see Privacy Policy
Compliance & Standards
We align with modern privacy frameworks and security best practices. Formal certifications vary by plan and deployment — contact us for current scope.
PIPEDA
Privacy principles aligned with Canadian federal law.
CPRA
Consumer privacy rights and data minimization practices.
GDPR
Privacy-by-design principles aligned with EU regulation.
- Encryption and key management aligned with AWS best practices
- Data residency controls (US / Canada) and documented lifecycle deletion
Responsible Disclosure
We appreciate reports from the security community. If you believe you've discovered a vulnerability, please reach out privately so we can investigate and remediate quickly.
Contact
Questions about how we protect your data?