Legal and security
Everything a company needs to read, or to give its lawyers, before building on IRLProof. Last updated 15 September 2026.
Documents
What we promise, what we do not, and what a proof does and does not say. Draft.
What is taken from an ID, what is kept, for how long, and what can never be produced because it is not stored. Draft.
Data processing agreement
Not written yet. Ask at privacy@irlproof.me and we will work from your paper or ours.
Security questionnaire
No certification yet, and we will not imply one. Send yours and we will answer it honestly.
How the service is built, in security terms
- Identity dataNo name, date of birth, address, document number or photo is written anywhere. What is kept describes the document and its issuer. See the privacy policy.
- In transitHTTPS everywhere, with the sign-in flow ending at addresses each site registers in advance.
- At restEncrypted. The key that turns a document number into an irreversible fingerprint is held in a separate managed key store, not in the application database.
- Key rotationSigning keys, encryption keys and the fingerprint key are rotated through a deliberate, logged procedure, with previous keys retained so nothing already issued stops verifying.
- SeparationEach site receives its own identifier for a person, so two sites cannot compare their users, and a breach of one tells an attacker nothing about another.
- Console accessOrganizations, roles, and an activity log naming who changed what. See Developer docs.
Who else is involved
The service runs on Microsoft Azure (application, database, secrets), sends email through Azure Communication Services, and uses Cloudflare for DNS. Credential verification runs in our own deployment of OpenCred, the open-source verifier from the California DMV and Digital Bazaar. No advertising or analytics vendor receives anything derived from an ID.
Reporting a security problem
Email privacy@irlproof.me with "security" in the subject. Tell us what you found and how to reproduce it. We will reply, and we will not threaten you for telling us.