Data handling
| Question | Answer |
|---|---|
| Do you store my media? | No. Assets are verified in memory and discarded. Nothing you upload is persisted, cached, or written to disk. |
| What is stored? | Evidence files you explicitly generate: the asset's SHA-256 hash, verification verdicts, timestamps, and our signature. The evidence file does not contain the asset itself. |
| Retention | Evidence files and the console database live on a persistent disk and survive redeploys. Retention windows are set per agreement (30/90/365 days); automated purge is on the roadmap, and deletions are honoured on request in the meantime. |
| Training on customer data | Never. The service is deterministic verification software — there are no models to train. |
Platform security controls
| Control | Detail |
|---|---|
| Transport | TLS terminated at the hosting edge; HTTPS only. |
| SSRF guard | URL fetches resolve DNS and reject non-public addresses (loopback, RFC-1918, link-local/metadata endpoints, CGNAT, IPv6 ULA). See utils::fetch_asset. |
| Rate limiting | Fixed-window per-IP limit on all mutating endpoints (default 20/min) with 429 + Retry-After; violations are logged with the source IP. |
| Request limits | 10 MB per asset; 50 files / 50 MB per batch; global body cap. |
| Authentication | Optional API key (x-api-key, constant-time compare) and signed browser sessions (Ed25519, 7-day expiry) for pilot accounts. Passwords are stored only as SHA-256 hashes. |
| Login protection | 5 attempts/min/IP throttle, honeypot bot field, failed attempts logged. |
| Security headers | CSP (self + inline), HSTS (2 years), X-Frame-Options DENY, nosniff, Referrer-Policy, on every response. |
| Dependency scanning | cargo audit against Cargo.lock; transitive findings (rsa Marvin timing, unmaintained proc-macro-error) reviewed — verification-only usage, no secret-key RSA operations. |
| Observability | Every request carries an x-request-id for log correlation. |
Evidence integrity
Evidence files are signed with the platform's Ed25519 key over a canonical JSON serialization (sorted keys, no whitespace, signature fields excluded). Verification is offline and deterministic: strip signature/signingKeyId, canonicalize, verify against the published platform public key. Certificate-chain verdicts are enforced against the official C2PA trust list (see /v1/trust-roots); the list is refreshed on a regular deploy cadence and the active anchor set is always queryable.
Hosting & data residency
Hosted on Render, Frankfurt (EU Central) region. EU data residency by default; dedicated/VPC deployment is available on the Enterprise tier.
Subprocessors
| Vendor | Role | Data shared |
|---|---|---|
| Render (render.com) | Hosting / compute | Request traffic in transit; evidence files at rest |
Customers are notified before any subprocessor is added or changed.
Known limitations & roadmap
Stated plainly, because trust requires it:
| Item | Status |
|---|---|
| OCSP revocation enforcement | Enabled (best-effort: stapled responses validated, live responder queries when reachable; outages degrade to "skipped" and are surfaced in the response's errors). |
| SynthID watermark detection | Pending Google's API (waitlist only). Meanwhile: optional TrustMark detector sidecar (detector/ service) + AI-generator metadata hints (exif.generator_hint). |
| SOC 2 Type II | Not started — roadmap 2027. |
| SSO / SAML | Enterprise tier, on request. |
Vulnerability disclosure
Report security issues to hello@vaelistrust.com with subject SECURITY. We acknowledge within one business day and credit reporters (with permission) after fixes ship.
GDPR
We process no personal data beyond standard server logs (IP, user agent, timestamps) and pilot-account email addresses. Evidence files contain content hashes, not media or personal data. A GDPR Art. 28 DPA template is available on request for pilot customers.