Security
What protects your data, stated precisely, including where the limits are.
Encryption at rest
Every identity fact is encrypted on its own with AES-256-GCM. Each record uses its own data key, wrapped by a customer-managed key in AWS KMS in the Mumbai region. The wrapping key cannot be exported; unwrapping needs an authorised call to KMS.
Post-quantum signatures
Proofs are SD-JWT credentials signed with ML-DSA-87 (NIST FIPS 204), a lattice-based signature designed to resist attack by quantum computers. The signing key lives in AWS KMS and never leaves it. Signatures are 4,627 bytes and are checked on the server.
Selective disclosure
Each fact is hashed with a random salt and only the hash is signed. The verifier receives the salts for facts you approved. The rest stay as hashes that cannot be reversed or guessed.
Verifier controls
Only signed-in, registered verifier accounts can open a proof, and only one issued to their organisation. A code works once, expires after ten minutes, and every check (granted or denied) is recorded. Repeated attempts are rate-limited.
Public timestamp
An optional timestamp on the Ethereum Sepolia test network stores hashes only. It proves when a key and signature existed; it holds no personal data, and signature verification itself happens off-chain.
Limits
Identity details are self-declared in this sandbox and are not checked against a government source. Verity makes no claim that the system is unhackable, and a password that is guessed or reused can still expose an account.
Read how we handle data in the Privacy Policy.
Reporting a vulnerability
If you find a weakness, please tell us privately at the security contact to be published before launch and give us reasonable time to fix it before disclosing it. Please do not access other people’s data while testing.