SecuritySecurity
Enterprise-grade security. Transparent practices. Continuous improvement.
Every proof package is digitally signed with Ed25519 elliptic curve cryptography. This ensures:
- ✓ Tamper-evident: Any modification invalidates the signature
- ✓ Verifiable: Anyone can verify signature authenticity
- ✓ Non-repudiable: Proof of issuance by ProofOS
- ✓ Portable: Works offline, no ProofOS infrastructure required
Algorithm: Ed25519
Key Length: 256 bits
Hash Function: SHA-512
Standard: RFC 8032
All claim data is encrypted at rest with AES-256-GCM. Each wallet has a unique encryption key.
- ✓ Per-wallet keys: Breach of one wallet doesn't compromise others
- ✓ Zero plain-text PII: Database admins cannot read claim data
- ✓ NIST-approved: NSA Suite B compliant
- ✓ Galois/Counter Mode: Authenticated encryption (integrity + confidentiality)
We welcome security researchers to report vulnerabilities responsibly. We are committed to addressing security issues promptly.
How to Report
- 1. Email security findings to: security@proofos.com
- 2. Include: vulnerability description, steps to reproduce, impact assessment
- 3. Do not publicly disclose until we've addressed the issue
- 4. We will acknowledge within 48 hours
- 5. We aim to fix critical issues within 7 days
Out of Scope
- ✗ Social engineering
- ✗ Denial of service attacks
- ✗ Physical security
- ✗ Third-party services
Hall of Fame: We publicly acknowledge researchers who report valid vulnerabilities (with permission).
In the event of a security incident:
- 1. Affected users notified within 24 hours
- 2. Incident details published on status page
- 3. Forensic investigation conducted
- 4. Post-mortem report published (within 7 days)
- 5. Preventive measures implemented
For security concerns, vulnerability reports, or compliance inquiries:
Email: security@proofos.com
PGP Key: Available on request
Response Time: Within 48 hours
We maintain a public security changelog of patches and improvements. Subscribe to security advisories at security@proofos.com.