Security is the whole product.
OKIAS handles some of the most sensitive data there is — identity documents, faces and biometric signals. This page explains, honestly, how we protect it: how data is encrypted, who can access it, how long we keep it, and how to reach us if you find a problem.
Encrypted in transit and at rest.
Sensitive fields are encrypted before they touch disk, and everything travels over modern TLS. We minimise what we keep and encrypt what we do.
Field-level encryption at rest
Extracted personally identifiable information is encrypted at the field level with AES-256-GCM authenticated encryption before it is stored, so a database snapshot alone never exposes plaintext PII.
Encryption in transit
All API and dashboard traffic is served over HTTPS with TLS 1.2 or higher. Credentials, verification media and results are never transmitted in the clear.
Password hashing
Account passwords are hashed with argon2id — a memory-hard algorithm resistant to GPU/ASIC cracking. We never store plaintext passwords, and login timing is equalised to resist account enumeration.
Secret management
Encryption keys and third-party credentials are held in dedicated secret storage, separated from application data, and rotated when required.
Least privilege, by default.
Access to production and to customer data is scoped to what a role actually needs, and every sensitive change is recorded.
Team roles & MFA
Accounts support multi-factor authentication, and team roles scope what each member of your organisation can see and do inside the dashboard.
Role-based, least-privilege access
Internal access follows least-privilege and role-based controls. Staff receive only the access their role requires, and elevated access is limited and reviewed.
Audit logging
Sensitive actions are logged to support investigation and accountability. The credit ledger is append-only, enforced at the database level — entries can be added but never edited or deleted.
Network isolation
Services run with network isolation and segmentation, so components are not needlessly exposed to one another or to the public internet.
Rate limiting & abuse protection
Public and authenticated endpoints are rate-limited. Signup and login apply additional anti-abuse controls to blunt credential stuffing, scraping and enumeration.
Dual-control on money movement
Every partner payout is manually reviewed before release, and payouts of $500 or more require approval from two separate admins.
Precise about what we have.
We build to recognised control frameworks and screen against official government lists. We are exact about what holds today versus what we are working toward.
GDPR-aligned processing
Processing is built around GDPR principles: lawful basis, data minimisation, purpose limitation, storage limitation, and data-subject rights. Our Data Processing Agreement and sub-processor list are published at okias.io/legal/dpa.
SOC 2 — working toward attestation
We maintain SOC 2-aligned controls — encryption, least-privilege access, network isolation and audit logging — and are working toward a formal attestation. We do not claim a certification we do not yet hold.
ISO 27001-aligned controls
Our security programme follows ISO 27001-aligned control areas — access management, cryptography, operations security and incident response. We are not ISO 27001 certified and do not claim to be.
Sanctions screening — beta
Full verifications are screened against OFAC, EU, UN and UK sanctions lists, with explainable reason codes returned to support the customer’s own decision. The screening capability is in beta.
We never list a certification we have not earned. When our compliance posture changes — for example, when a SOC 2 attestation completes — this page will say so explicitly.
Kept only as long as needed.
Verification data exists to produce a decision, is retained for a configured period, and individuals keep the rights the law gives them.
Data minimisation & retention
Verification media is used to produce a decision, is not used to train general-purpose models, and is retained only for the customer’s configured period before it is deleted or de-identified.
Deletion requests
Individuals can access, rectify, port, restrict, object to and erase their personal data, and withdraw consent. Because OKIAS is usually a processor for End-User data, End Users should first contact the organisation that submitted them; account holders may exercise rights directly at security@okias.io.
Biometric & PII handling
Face-match and liveness processing is carried out only to perform the requested verification, on a lawful basis, and — where required — under explicit End-User consent obtained by our customer. Extracted PII is stored encrypted and retained only for the configured period.
No model training on your data
Customer and End-User data is processed solely to deliver the verification the customer requested. It is never sold, and never used to train foundation models.
Full detail lives in our Privacy Policy and, for controller/processor engagements, in our Data Processing Agreement, which includes standard contractual clauses for international transfers.
Built to reject fakes.
Every selfie passes an active liveness challenge — a randomised action sequence your user cannot pre-record — plus presentation-attack detection (PAD), so a photo of a photo never becomes an approved identity.
Print attacks
Printed photos, paper masks and cut-outs are flagged by texture, depth and reflectance cues that flat reproductions cannot fake.
Screen replay
Photos or videos replayed from a phone, tablet or monitor are caught through moiré, glare and display-artefact signals.
Deepfakes
Synthetic and manipulated faces are analysed for generation artefacts and inconsistencies before a selfie can pass liveness.
No detector is perfect — verification is probabilistic. Ambiguous captures are routed to review rather than silently approved, and every decision ships with reason codes.
Boring, in the good way.
Managed platforms, encrypted storage and visible operations — nothing exotic between your users and their verification.
Managed, patched infrastructure
The platform runs on managed cloud infrastructure with encrypted storage, kept patched and current rather than hand-rolled.
Hosting, stated plainly
OKIAS currently operates from a single hosting region. Our infrastructure sub-processors are listed in our DPA, and this page will say so when additional regions exist.
Transparent operations
A public status page derived from the live health signal, signed webhooks, and a full audit trail on every account action. We operate to a 99.9% uptime target.
Explainable decisions
Reason codes, signal weights and model versions ship with every approve, review or decline — auditable by design.
Report a vulnerability.
No system is perfectly secure. If you believe you have found a vulnerability, we want to hear from you. Email us with enough detail to reproduce the issue and we will acknowledge your report and work with you on a fix.
security@okias.ioPlease do
- Give us reasonable time to investigate and remediate before any public disclosure.
- Provide clear steps to reproduce, along with any relevant logs or proof-of-concept.
- Test only against your own account and data.
Please don’t
- Access, modify or delete data that is not yours, or degrade the service for others.
- Run automated scanning that generates disruptive load or spam.
- Attempt social engineering, phishing or physical attacks against staff.
Questions from security or procurement?
We answer security reviews, and our Data Processing Agreement and sub-processor list are published for you to read before you ever talk to us.