Docs / Security
Security model at a glance
Encryption in transit, signed outcomes, least-data handling, and operational key rotation for production integrity.
Security controls
Encrypted signals
Verification signals are encrypted in transit between browser, API, and server components.
Keys
API keys are server-only credentials. Rotate on schedule and revoke immediately on suspected exposure.
Signatures
Final outcomes and webhook payloads are signed so backend systems can validate authenticity.
Least data
No stored photos, no templates, and minimal retained metadata aligned to product operation.
Operational security
Use environment separation, access controls, key ownership, and recurring rotation runbooks.
Monitoring
Track signature failures, retry spikes, stale-token rates, and abnormal result-submission behavior.
Operational checklist
- Rotate API keys on a fixed schedule and immediately on suspected exposure.
- Separate test and production credentials and environments.
- Restrict key access to least-privilege service identities.
- Run webhook signature failure alerts with clear on-call ownership.
- Document incident response steps for expired tokens and repeated result-submission failures.