Credential proofs
Issuer credentials use Ed25519 Data Integrity proofs and W3C Verifiable Credentials 2.0 JSON-LD output.
Security / implementation evidence
Trust claims should resolve to a control you can inspect.
This page describes controls supported by the current codebase. It does not claim SOC 2, ISO 27001, GDPR/CCPA certification, penetration-test coverage, or a contractual SLA.
Implemented controls
What the platform does today
Issuer identity
Issuer identity is represented with did:web DID documents published by the application.
Revocation status
Per-organization status lists communicate whether an issued credential has been revoked.
Private-key storage
Issuer private keys are encrypted with AES-256-GCM before they are stored in the database. The encryption key is supplied as a server secret.
Application access
Supabase Row Level Security policies, database-checked organization membership, and scoped permission checks form the tenant-access model.
Integration safeguards
API keys are scoped and stored as SHA-256 hashes. Outbound webhooks are signed and retried; relevant production auth controls fail closed when required secrets or rate-limit storage are unavailable.
Procurement
Requirements are reviewed, not presumed
The following material is available only when the business can supply a current document or agree contractual terms. Contact us to confirm availability and scope.
- Data-processing and subprocessor informationOn request
- Retention and deletion informationOn request
- Incident-response and continuity informationOn request
- Accessibility and support requirementsOn request
- Contractual service-level requirementsOn request