Your data is safe, private, and compliant.
Security isn’t something we added on top — it’s built into how ANANKE works. Your data is encrypted, isolated, and protected at every layer. Personal data is never published to external systems, and every action has a verifiable audit trail. Designed for GDPR, aligned with eIDAS and DGSSI standards.
How we protect your organization
Six security commitments that apply to every organization using ANANKE.
Your data is encrypted and isolated
All stored data is encrypted with industry-standard encryption. Each organization's data, proofs, and configurations are fully separated. There is no way for one organization to access another's information.
No personal data is ever published
When we publish external verification evidence, only non-personal references are shared externally. No names, no document content, no personal information are ever published.
Cryptographic keys in hardware security modules
Signing keys are stored in certified hardware security modules. Private keys never leave the HSM boundary, and signing operations happen inside secured hardware.
You control what verifiers see
When someone verifies a record you issued, they only see the information you chose to share. Different verifier types can see different fields. You set the rules.
Everything is encrypted
All data is encrypted in storage and in transit. Sensitive fields use envelope encryption with keys managed in hardware. Communication between services uses TLS. No unprotected data at rest.
Complete audit trail
Every issuance, verification, revocation, and access event is recorded with timestamps. If you need to show what happened and when, the evidence is already there.
What we store, and what we don't
Transparency about data handling starts with being clear about what touches our systems.
What we store
What we never publish or expose
Compliance and regulatory alignment
We design for compliance from day one, not as an afterthought. Below are the frameworks ANANKE is being built to align with. Important: These are work-in-progress design goals, not completed certifications or formal agreements.
GDPR
General Data Protection Regulation (EU)
eIDAS
Electronic Identification & Trust Services (EU)
DGSSI
Direction Générale de la Sécurité des Systèmes d’Information (Morocco)
ISO 27001
Information Security Management (International)
Access control and authentication
Controlling who can access what, and proving it.
Each team member has specific permissions based on their role. Administrators, issuers, verifiers, and auditors each see and do only what they need to.
Built-in OpenID Connect authentication with ANANKE’s own identity provider. Tokens are cryptographically signed. Multi-factor authentication support is available for enhanced security.
API keys are secured using strong one-way hashing. The raw key is shown once at creation and never stored — only a hashed representation and metadata are retained. Keys are scoped to your organization.
Automatic session expiration, secure token handling, and protection against common web security threats (CSRF, XSS, injection attacks).
Governance, you stay in control
ANANKE provides the tools. Your organization sets the policies.
You define the rules
Your organization controls proof policies, verification settings, team permissions, and what information is disclosed to verifiers.
Every action is recorded
Issuance, verification, revocation, access changes, everything is logged with who did it, when, and from where.
Tamper-evident history
Audit logs are protected so that any attempt to modify historical records is detectable. Your evidence trail is trustworthy.
Long-term retention
Audit records are retained for regulatory periods. When auditors or regulators request evidence, it’s already there and proven.
Non-qualified vs. qualified trust services
ANANKE Trust and T-CODE are non-qualified trust services— they provide verifiable evidence and tamper-detection, not legally qualified electronic signatures. For workflows requiring legally binding signatures (contractual, regulatory), ANANKE Sign is a separate product line that will operate under DGSSI/eIDAS regulatory certification. Learn more about ANANKE Sign.
Questions about security or compliance?
We’re happy to discuss our security practices, data handling, and compliance alignment with your IT, legal, or compliance team.