Security
Cryptographic Security
SHA-256 Hashing
All data is hashed using the SHA-256 cryptographic algorithm, ensuring data integrity and creating unique digital fingerprints.
Ed25519 Signatures
Digital signatures using Ed25519 elliptic curve cryptography provide authentication and non-repudiation. Our signing public key is published so anyone can independently verify signatures.
Merkle Trees
Merkle tree structures enable efficient verification of large datasets while maintaining cryptographic proofs.
Immutable Records
Blockchain records are permanent and any modification is cryptographically detectable. You can redact your submitted data while the underlying proof records remain intact and verifiable.
Data Protection
- Data Minimization: Files you timestamp are hashed in your browser and never uploaded to us. We store the claims you choose to submit until you redact or delete them, and only hash values ever reach any blockchain
- Encryption in Transit: All communications are encrypted in transit using TLS
- Secure Authentication: API access via expiring, revocable API keys with secure hashed storage
- Access Controls: Role-based permissions and team isolation
Account Security
- Passkeys: Sign in with a passkey instead of a password, backed by your device's biometrics or a hardware security key. Passkeys here always require user verification, so having the device is not enough on its own.
- Two-factor authentication: Time-based one-time codes from an authenticator app, with rate limiting on verification attempts.
- Recovery codes: Single-use codes you generate and keep yourself, so a lost passkey or authenticator does not lock you out.
- Account activity: Your profile lists sign-ins and account changes with the IP address each came from, so you can spot access you do not recognize.
- Connected applications: Applications you authorize receive only the access you consent to, and you can revoke any of them at any time.
Infrastructure Security
Application Security
- Secure coding practices
- Regular dependency updates
- Dependency advisory scanning on every change
- Static analysis on every change
- Input validation and sanitization
- Rate limiting on sign-in and write actions
Operational Security
- Availability monitoring and alerting
- Incident response procedures
- Backup and recovery systems
- Environment isolation
Verification & Transparency
Our security model is built on transparency and verifiability:
- All timestamps can be independently verified using cryptographic proofs
- Blockchain ledger provides transparent audit trail
- Open verification tools allow third-party validation
- Cryptographic evidence can be verified offline
Reporting Security Issues
If you discover a security vulnerability, please report it to our team at [email protected]. We appreciate responsible disclosure and will work with you to address any issues promptly.
- In scope: The Truestamp web application at www.truestamp.com, our public API, and the verification tools and libraries we publish.
- Out of scope: Scanner output with no demonstrated impact, denial of service and volumetric testing, social engineering of our staff or customers, physical access attempts, and services operated by third parties.
- Safe harbor: We will not pursue legal action over good-faith research that stays in scope, uses only your own accounts and test data, stops at a proof of concept, and neither disrupts the service nor exposes anyone else's data.
- What to expect: We aim to acknowledge your report within three business days, and to tell you whether we could reproduce it and what we plan to do. Please give us 90 days before publishing details, or a shorter window if we agree on one.