Security & compliance

Your data is safe, private, and compliant.

Security isn’t something we added on top — it’s built into how ANANKE works. Your data is encrypted, isolated, and protected at every layer. Personal data is never published to external systems, and every action has a verifiable audit trail. Designed for GDPR, aligned with eIDAS and DGSSI standards.

Security

How we protect your organization

Six security commitments that apply to every organization using ANANKE.

Your data is encrypted and isolated

All stored data is encrypted with industry-standard encryption. Each organization's data, proofs, and configurations are fully separated. There is no way for one organization to access another's information.

No personal data is ever published

When we publish external verification evidence, only non-personal references are shared externally. No names, no document content, no personal information are ever published.

Cryptographic keys in hardware security modules

Signing keys are stored in certified hardware security modules. Private keys never leave the HSM boundary, and signing operations happen inside secured hardware.

You control what verifiers see

When someone verifies a record you issued, they only see the information you chose to share. Different verifier types can see different fields. You set the rules.

Everything is encrypted

All data is encrypted in storage and in transit. Sensitive fields use envelope encryption with keys managed in hardware. Communication between services uses TLS. No unprotected data at rest.

Complete audit trail

Every issuance, verification, revocation, and access event is recorded with timestamps. If you need to show what happened and when, the evidence is already there.

Data handling

What we store, and what we don't

Transparency about data handling starts with being clear about what touches our systems.

What we store

Protected PDFs with embedded verification evidence
Document metadata, lifecycle status, and template configurations
Cryptographic fingerprints (hashes) and verification proof records
Verification timestamps with optional external evidence references
Audit trail entries (append-only, timestamps, actor identity)
API key metadata (hashed, never in readable form)
Your organization's settings and configurations

What we never publish or expose

No document content or personal data on public networks, only minimal non-personal verification references
No passwords or API key secrets in readable form, hashed with strong algorithms
No cross-organization data access, database-level isolation enforced
No unencrypted personal information at rest
No financial or payment details, handled by separate payment processors
Compliance

Compliance and regulatory alignment

We design for compliance from day one, not as an afterthought. Below are the frameworks ANANKE is being built to align with. Important: These are work-in-progress design goals, not completed certifications or formal agreements.

GDPR

General Data Protection Regulation (EU)

Data minimization, we only process what’s necessary
Purpose limitation, data is used only for verification
Right to erasure compatibility
Privacy by design and by default
No personal data transferred to third parties without consent
Data processing agreements available for enterprise clients

eIDAS

Electronic Identification & Trust Services (EU)

Trust and TCODE operate as non-qualified trust services
Architecture designed for future qualified status via ANANKE Sign
Cross-border interoperability standards followed
Clear disclosure: non-qualified services are clearly labeled
ANANKE Sign is being designed for qualified trust service certification
Standards-compatible proof formats for European recognition

DGSSI

Direction Générale de la Sécurité des Systèmes d’Information (Morocco)

Architecture aligned with Moroccan digital trust requirements
Clear separation between non-qualified and qualified services
ANANKE Sign planned for DGSSI certification
Trust services mapped to DGSSI trust level classifications
Security practices aligned with national cybersecurity directives
Moroccan data residency considerations addressed

ISO 27001

Information Security Management (International)

Security controls aligned with ISO 27001 requirements
Risk assessment and treatment processes in place
Access control policies enforced at every level
Incident response procedures documented and tested
Continuous monitoring and improvement cycle
Working toward formal certification
Access

Access control and authentication

Controlling who can access what, and proving it.

Role-based permissions

Each team member has specific permissions based on their role. Administrators, issuers, verifiers, and auditors each see and do only what they need to.

Secure authentication

Built-in OpenID Connect authentication with ANANKE’s own identity provider. Tokens are cryptographically signed. Multi-factor authentication support is available for enhanced security.

API key protection

API keys are secured using strong one-way hashing. The raw key is shown once at creation and never stored — only a hashed representation and metadata are retained. Keys are scoped to your organization.

Session management

Automatic session expiration, secure token handling, and protection against common web security threats (CSRF, XSS, injection attacks).

Governance

Governance, you stay in control

ANANKE provides the tools. Your organization sets the policies.

You define the rules

Your organization controls proof policies, verification settings, team permissions, and what information is disclosed to verifiers.

Every action is recorded

Issuance, verification, revocation, access changes, everything is logged with who did it, when, and from where.

Tamper-evident history

Audit logs are protected so that any attempt to modify historical records is detectable. Your evidence trail is trustworthy.

Long-term retention

Audit records are retained for regulatory periods. When auditors or regulators request evidence, it’s already there and proven.

Non-qualified vs. qualified trust services

ANANKE Trust and T-CODE are non-qualified trust services— they provide verifiable evidence and tamper-detection, not legally qualified electronic signatures. For workflows requiring legally binding signatures (contractual, regulatory), ANANKE Sign is a separate product line that will operate under DGSSI/eIDAS regulatory certification. Learn more about ANANKE Sign.

Questions about security or compliance?

We’re happy to discuss our security practices, data handling, and compliance alignment with your IT, legal, or compliance team.