Security, GDPR and UK data
How we protect API traffic and personal data, where data is held, and your GDPR responsibilities.
Where your data is stored#
For UK accounts, check data and documents are stored in the United Kingdom, in the AWS London region (eu-west-2). The API is at api.trustverify.co.uk.
UK GDPR#
- We are registered with the Information Commissioner's Office, registration ZB962144.
- Your obligations under the UK GDPR and the Money Laundering Regulations stay with you; our checks and records help you evidence them.
- Send only the data a check needs, and use the sandbox with made-up data while you build.
- How we handle personal data is in our privacy policy.
Security controls in place today#
- The site and the API are served only over HTTPS (TLS 1.2 or 1.3). Plain HTTP is redirected.
- API keys are stored only as SHA-256 hashes. The full key is shown once, when you create it.
- An API key can call the API but can never sign in to the dashboard.
- Passwords are hashed with Argon2id, and repeated failed sign-ins lock the account for a while.
- Dashboard sessions are held on our servers. Your browser keeps only a random session ID, in an HttpOnly cookie sent only over HTTPS, and the session ends after a period of inactivity.
- Audit events are written to an append-only table: the database rejects any change to a recorded event, and any deletion before its retention period ends.
- Security headers and rate limits apply to every API request.
- Report a vulnerability to security@trustverify.co.uk. We aim to acknowledge reports within 2 business days.
Planned
- Two-factor authentication for dashboard accounts, using a code from an authenticator app.
A control that is not listed under “In place today” is not in place. We add controls to that list only when they are running.
Your side#
- Keep API keys on your servers and restrict live keys by IP.
- Verify every webhook signature.
- Report a vulnerability to security@trustverify.co.uk.
More detail is on our security page.