Security Whitepaper

Each institution operates in an isolated tenant scope. Data access is enforced by tenant identifiers on every record and validated at the database layer, not only in application code.

Row-Level Security policies enforce access rules directly in the database. Even if application code contained a bug, cross-tenant reads or writes remain blocked at the storage tier.

Role-Based Access Control assigns least-privilege permissions across institution roles (admin, issuer, verifier, auditor) and platform roles (support, super admin), stored in a dedicated roles table and evaluated by security-definer functions.

• Secure email/password and OAuth-based sign-in.
• Session tokens with short lifetimes and refresh rotation.
• Protection against session fixation and CSRF for state-changing calls.

MFA-capable authentication is available for sensitive roles. We recommend institutions enforce MFA for admin and issuer accounts.

Sensitive actions — credential issuance, revocation, role changes, API key rotations — write to an append-oriented audit log accessible to institution admins and the platform's super-admin audit centre.

All traffic to Verify.ug is served over TLS 1.2 or higher, with HSTS enabled and strong ciphers preferred.

Managed database and object storage are encrypted at rest by our infrastructure providers. Secrets are stored in a dedicated secret manager and never checked into source.

• Bearer token authentication with per-institution keys.
• Sliding-window rate limiting and usage accounting.
• Per-key scopes and rotation controls.
• Signed webhook payloads for outbound events.

• Authenticity confidence scores, fraud-risk signals and duplicate detection.
• Explainable outputs stored as auditable events.
• Guardrails to prevent AI outputs from overriding institutional records.

Credentials are stored with tamper-evident signatures. Revocation is enforced during verification so that revoked credentials fail every check immediately.

QR payloads reference short verification identifiers rather than sensitive personal data. Verification is performed server-side against signed records.

We monitor availability, error rates and abuse signals. Anomalies trigger internal alerts for on-call review.

We maintain an internal incident-response process covering detection, triage, containment, recovery and post-incident review. Customers affected by an incident are notified without undue delay.

Our recovery approach relies on managed database point-in-time recovery, redundant object storage and infrastructure-as-code so services can be rebuilt from source.

Managed backups run on a rolling schedule with retention appropriate to operational recovery. Backup integrity is periodically validated.