Security is the whole product.
OKIAS handles some of the most sensitive data there is — identity documents, faces and biometric signals. This page explains, honestly, how we protect it: how data is encrypted, who can access it, how long we keep it, and how to reach us if you find a problem.
Encrypted in transit and when stored.
Data is encrypted in transit (TLS) and when stored, with field-level AES-256-GCM encryption for sensitive personal data. During capture, images are held briefly (up to 30 minutes) in a server-side cache before they are stored encrypted.
Field-level encryption at rest
Extracted personally identifiable information is encrypted at the field level with AES-256-GCM authenticated encryption before it is stored, so a database snapshot alone never exposes plaintext PII.
Encryption in transit
All API and dashboard traffic is served over HTTPS with TLS 1.2 or higher. Credentials, verification media and results are never transmitted in the clear.
Password hashing
Account passwords are hashed with argon2id — a memory-hard algorithm resistant to GPU/ASIC cracking. We never store plaintext passwords, and login timing is equalised to resist account enumeration.
Secret management
Encryption keys and third-party credentials are kept in server-side environment configuration, never in client code or the database, and are rotated when a credential is exposed. A dedicated secret manager and scheduled key rotation are on our roadmap.
Least privilege, by default.
Access to production and to customer data is scoped to what a role actually needs, and every sensitive change is recorded.
Multi-factor authentication
Accounts support multi-factor authentication. Workspaces are single-owner today; team members and roles are on the roadmap.
Role-based, least-privilege access
Internal access follows least-privilege and role-based controls. Staff receive only the access their role requires, and elevated access is limited and reviewed.
Audit logging
Sensitive actions are logged to support investigation and accountability. The credit ledger is append-only, enforced at the database level — entries can be added but never edited or deleted.
Limited exposure
Only the web and API endpoints are exposed to the internet, behind TLS. Finer network segmentation between internal components is on our roadmap.
Rate limiting & abuse protection
Public and authenticated endpoints are rate-limited. Signup and login apply additional anti-abuse controls to blunt credential stuffing, scraping and enumeration.
Dual-control on money movement
Every partner payout is manually reviewed before release, and payouts of $500 or more require approval from two separate administrators.
Precise about what we have.
What is in production today, what we can show evidence for, and which certifications we do not hold.
GDPR-aligned processing
Processing is built around GDPR principles: lawful basis, data minimisation, purpose limitation, storage limitation, and data-subject rights. Our Data Processing Agreement and sub-processor list are published at okias.io/legal/dpa.
No SOC 2 or ISO 27001 certification
OKIAS does not currently hold a SOC 2 attestation or an ISO 27001 certification, and no audit report can be provided today. The controls we do run are described on this page.
Every document view is audited
Identity documents and selfies are stored encrypted in private storage and served only through short-lived links (five minutes, five uses) that are re-authorised on every request. Each view is written to a hash-chained audit log.
Sanctions screening — beta
Full verifications are screened against OFAC, EU, UN and UK sanctions lists, with explainable reason codes returned to support the customer’s own decision. The screening capability is in beta.
We never list a certification we have not earned. If we obtain an independent certification, this page will say so explicitly.
Kept only as long as needed.
Verification data exists to produce a decision, is retained for a configured period, and individuals keep the rights the law gives them.
Data minimisation & retention
Verification media is used to produce a decision, is not used to train general-purpose models, and is retained only for the customer’s configured period before it is deleted or de-identified.
Deletion requests
Individuals can access, rectify, port, restrict, object to and erase their personal data, and withdraw consent. Because OKIAS is usually a processor for End-User data, End Users should first contact the organisation that submitted them; account holders may exercise rights directly at security@okias.io.
Biometric & PII handling
Face-match and liveness processing is carried out only to perform the requested verification, on a lawful basis, and — where required — under explicit End-User consent obtained by our customer. Extracted PII is stored encrypted and retained only for the configured period.
No model training on your data
Customer and End-User data is processed solely to deliver the verification the customer requested. It is never sold, and never used to train foundation models.
Full detail lives in our Privacy Policy and, for controller/processor engagements, in our Data Processing Agreement, which includes standard contractual clauses for international transfers.
Designed to catch fakes.
Liveness is passive today: the applicant takes a short live selfie in the browser, and an AI model reviews several of the captured frames for signs of a printed photo, a screen replay or a mask. The selfie is then matched 1:1 to the document portrait. Low-confidence results are routed to review rather than approved. Server-verified active liveness (randomly selected movements checked on the server) is in development and is not yet in production.
Print attacks
Printed photos, paper masks and cut-outs are assessed by an AI model that reviews several live selfie frames. Uncertain results go to review rather than being approved.
Screen replay
Photos or videos shown on a phone, tablet or monitor are assessed by the same AI review for display artefacts such as glare and moiré.
Honest limits
We do not claim deepfake or injection-attack detection, and our liveness has no ISO 30107-3 / iBeta certification. Server-verified active liveness is in development.
No detector is perfect — verification is probabilistic. Ambiguous captures are routed to review rather than silently approved, and every decision ships with reason codes.
Boring, in the good way.
Managed platforms, encrypted storage and visible operations — nothing exotic between your users and their verification.
Managed, patched infrastructure
The platform runs on managed cloud infrastructure with encrypted storage, kept patched and current rather than hand-rolled.
Hosting, stated plainly
OKIAS currently operates from a single hosting region. Our infrastructure sub-processors are listed in our DPA, and this page will say so when additional regions exist.
Transparent operations
A public status page showing current API and database health, signed webhooks, and an audit trail of staff actions. We do not publish an uptime figure: the platform runs on a single region and the status page shows current state, not history.
Explainable decisions
Every approve, review or decline carries machine-readable reason codes and a risk score; for AI-scored checks, the verification detail adds the per-stage scores and weights behind the result — auditable by design.
Report a vulnerability.
No system is perfectly secure. If you believe you have found a vulnerability, we want to hear from you. Email us with enough detail to reproduce the issue and we will acknowledge your report and work with you on a fix.
security@okias.ioPlease do
- Give us reasonable time to investigate and remediate before any public disclosure.
- Provide clear steps to reproduce, along with any relevant logs or proof-of-concept.
- Test only against your own account and data.
Please don’t
- Access, modify or delete data that is not yours, or degrade the service for others.
- Run automated scanning that generates disruptive load or spam.
- Attempt social engineering, phishing or physical attacks against staff.
Questions from security or procurement?
We answer security reviews, and our Data Processing Agreement and sub-processor list are published for you to read before you ever talk to us.