Security

In place today

• The site and the API are served only over HTTPS (TLS 1.2 or 1.3). Plain HTTP is redirected.
• API keys are stored only as SHA-256 hashes. The full key is shown once, when you create it.
• An API key can call the API but can never sign in to the dashboard.
• Passwords are hashed with Argon2id, and repeated failed sign-ins lock the account for a while.
• Dashboard sessions are held on our servers. Your browser keeps only a random session ID, in an HttpOnly cookie sent only over HTTPS, and the session ends after a period of inactivity.
• Audit events are written to an append-only table: the database rejects any change to a recorded event, and any deletion before its retention period ends.
• Security headers and rate limits apply to every API request.
• Report a vulnerability to security@trustverify.co.uk. We aim to acknowledge reports within 2 business days.

Planned — not available yet

• Two-factor authentication for dashboard accounts, using a code from an authenticator app.

A control that is not listed under “In place today” is not in place. We add controls to that list only when they are running.

Certifications

• UK GDPR — Registered with the ICO (ZB962144).

More detail is on our compliance page. To report a vulnerability, email security@trustverify.co.uk.