Security
Trust & Security
How we protect evidence, data and accounts — and what we will claim only once it is true.
[01]Evidence & chain of custody
Evidence integrity
- Every artefact is hashed (SHA-256) when acquired.
- Evidence is stored in EU-located, write-protected storage.
- A tamper-evident, hash-chained custody log records every access, regularly anchored by independent RFC 3161 timestamp authorities.
- Export packages include manifests, signatures, timestamps and instructions anyone can follow to verify them.
[02]
Data protection
- Data hosted in the EU (Frankfurt), with backups in a second EU region.
- Designed for GDPR, UK GDPR and Türkiye's KVKK, with data minimisation and documented lawful bases.
- Leaked data we encounter is minimised and credentials are never stored in clear or used.
[03]
Platform security
- Mandatory multi-factor authentication; passkeys and security keys supported.
- Case-level access control: users see only the cases they are assigned to.
- Encryption in transit and at rest, with per-customer keys for evidence.
- Administrative access only through zero-trust access controls with hardware security keys.
- Signed, scanned software builds and independent penetration testing.
[04]
Certifications
We are building our security management system to ISO/IEC 27001 and plan to pursue certification, followed by SOC 2 Type II. We will list certifications here only once they are issued.