Security

Architecture

• Per-tenant data-encryption keys (DEKs) derived via HKDF from a customer-master key.
• AES-256-GCM authenticated encryption on every biometric and document blob.
• Row-Level Security policies on every multi-tenant table.
• Write-once audit-logs table — UPDATE and DELETE revoked at the database level.

Access control

• JWT bearer tokens for dashboard sessions; short-lived (15 min) with rotation on refresh.
• API keys are SHA-256 hashed at rest; raw value shown once at creation.
• TOTP MFA available for every user; mandatory for owner/admin roles per tenant policy.
• WebAuthn / passkey support shipping in S15.

Operational

• Vulnerability disclosure: security@trustverify.co.uk. We respond within 2 business days and target a 90-day fix window.
• Quarterly third-party penetration tests scheduled from go-live.
• Continuous SAST + dependency scanning on every PR.