Privacy by design. Trust by default.
Identity data is the most sensitive data a person has. Our architecture assumes that any single layer can fail, and that no operator should be able to read your documents.
Four promises the architecture has to keep.
Everything further down this page exists to make these four true under pressure, not just on a slide.
Encryption
Data encrypted at rest and in transit with industry-standard cryptography.
User consent
Nothing is shared without an explicit, logged approval from you.
Biometric security
Face and fingerprint checks bind the credential to its owner.
NDPR compliance
Built to Nigeria's data protection regulation from day one.
Six layers, each assuming the others can fail.
No single control is load-bearing on its own. That is the point.
Encryption everywhere
TLS 1.3 in transit; AES-256 at rest. Document images and biometric templates are encrypted with per-user keys so a database copy alone reveals nothing.
Key management
Signing keys live in a hardware security module and never enter application memory. Credential signatures are verifiable without contacting us.
Binding to the person
Liveness-checked face matching and fingerprint verification tie the credential to its owner, so a stolen phone is not a stolen identity.
Minimum disclosure
Attribute-level sharing is the default path, not an advanced setting. Partners request the narrowest claim that answers their question.
Consent receipts
Every share writes an append-only record: who asked, what they received, when, and under what scope. You can read and revoke from your wallet.
Fraud detection
Document tampering signals, device reputation, and velocity checks run on every request, with anomalies escalated to human review.
Security is what we do daily, not what we claim once.
Architecture only holds if the people running it are constrained too.
This page describes the security architecture as designed and implemented. Where an external certification is in progress rather than held, the trust center says so explicitly.
Questions your security team needs answered?
We would rather have the hard conversation before you integrate than after.