Home · Legal

Security overview

Properties we ship and that you can verify in the open repository — not a marketing checklist of unshipped controls.

• Per-organization signing keys. Keys used to sign credentials are not available to internet-facing request workers; issuance signing runs in an internal worker path.
• Fail closed. Revocation status that cannot be confirmed is not accepted as valid. Weak algorithms are rejected.
• Tenant isolation. Tenant data is protected with database row-level security policies, not only application filters.
• Recipient contact encryption. Names and emails for recipients are encrypted under per-organization keys; erasure destroys access to that envelope.
• Two admin planes. The issuer panel and the platform console are visually and authorization-separated; the console cannot issue credentials.
• Open standards. Open Badges 3.0, W3C VC, status lists, OpenID4VCI / SD-JWT VC as documented on the landing page.

Source repository

Early-access draft. These pages describe the product as shipped today. They are not a substitute for a signed contract or a reviewed DPA where one is required.