Security
The whole product depends on keys no one else can use and records no one can quietly change. Here is how we protect both.
Controls
How we protect keys and data.
Keys in AWS KMS
Signing keys never leave KMS. Each batch signs with its own derived key.
Server-side reading
Private Codes are decoded only on our servers. Devices send camera frames and receive a verdict.
Encrypted and hashed
Secrets that must be read back are encrypted at rest. API keys and sessions are stored hashed.
Tenant isolation
Every record belongs to one workspace, and no request reads across workspaces.
SSO, SCIM and 2FA
SAML single sign-on, SCIM provisioning, passkeys and authenticator apps.
Audit log
Every signing, download and revocation is recorded and exportable.
Questions from your security team?
We’ll walk them through our architecture and controls.