Our compliance posture
What's in place today, what we're working toward, and how we protect the identity and transaction data our customers depend on — stated plainly, with no overstated claims.
Registrations and contacts
The details below match our published legal pages and can be checked against the public ICO register.
Legal entity
Magnificentech Solution Ltd, trading as TrustVerify
ICO registration
ZB962144 (UK GDPR / Data Protection Act 2018)
Data Protection Officer
Michael Omotayo — privacy@trustverify.co.uk
Certifications and frameworks
The registration in place today is with the ICO under UK GDPR.
UK GDPR
Registered with the ICO (ZB962144).
How we protect your data
In place today
- The site and the API are served only over HTTPS (TLS 1.2 or 1.3). Plain HTTP is redirected.
- API keys are stored only as SHA-256 hashes. The full key is shown once, when you create it.
- An API key can call the API but can never sign in to the dashboard.
- Passwords are hashed with Argon2id, and repeated failed sign-ins lock the account for a while.
- Dashboard sessions are held on our servers. Your browser keeps only a random session ID, in an HttpOnly cookie sent only over HTTPS, and the session ends after a period of inactivity.
- Audit events are written to an append-only table: the database rejects any change to a recorded event, and any deletion before its retention period ends.
- Security headers and rate limits apply to every API request.
- Report a vulnerability to security@trustverify.co.uk. We aim to acknowledge reports within 2 business days.
Planned — not available yet
- Two-factor authentication for dashboard accounts, using a code from an authenticator app.
A control that is not listed under “In place today” is not in place. We add controls to that list only when they are running.
Evidence you can check
Every evidence document carries a SHA-256 content digest you can re-verify at any time — returned on upload, on the X-Evidence-SHA256 download header, and from GET /api/compliance/evidence/{id}/digest. Regulatory evidence bundles include a manifest that lists the SHA-256 hash of every file in the archive.
Policies and documents
Our published policies are below. Detailed security documentation is available to customers and prospects under NDA.
Responsible disclosure
Found a security issue? We welcome coordinated disclosure. Email security@trustverify.co.uk with details and steps to reproduce. Please don't open a public issue for a suspected vulnerability.
Questions about compliance?
Our team is happy to walk you through our controls and share documentation under NDA. Data-protection enquiries go to our DPO via the contact details above.