Security
Last updated: 2026-09-24
Biometric evidence demands the highest care. This page summarizes the controls Trusty applies today.
Encryption
Encrypted in transit (TLS) and server-side encryption at rest for every biometric artifact we store.
Storage
Images and documents live in private storage, reachable only through authenticated, tenant-scoped endpoints. Evidence is never served from a public URL.
Access control
Per-tenant roles (administrator and analyst), optional TOTP two-factor authentication, and 12-hour sessions that end on sign-out, password change or suspension.
Embedding
Each client lists the domains that may embed the widget; while that list holds only the client’s own domains, embeds from other sites are refused. Sessions created through the API use expiring signed tokens.
Audit log
Sign-ins, configuration changes, views of verification details and evidence, searches, exports, erasures and manual decisions are recorded in a per-tenant audit log.
Webhooks
Each client has its own signing secret, rotatable from the backoffice. Signatures cover a timestamp and the raw body so receivers can reject replays.
Compliance
Security questionnaire available on request. Data processing agreement available on request. Designed for GDPR-aligned data handling.
Sub-processors
The third parties involved in processing are listed on the sub-processors page.
View sub-processorsReporting
To report a security issue or request the security questionnaire, email [email protected].