Skip to main content
IRON ID
Request a demo

Security

Security at IRON ID

Precise language, on purpose. Every line below describes a control that exists in the product today, or says plainly that it does not yet.

Explore the technologyTrust center

  • Encryption

    • Content is encrypted at rest with AES-256-GCM envelope encryption.
    • A distinct data key per content, wrapped by a managed key service.
    • The key service never sees the content: only the wrapped key travels to it.

  • Identity

    • Accounts, organizations, members, roles, invitations and API keys.
    • Human and machine identities share one lifecycle: creation, verification, revocation.
    • Signer certificates follow X.509; passwords are hashed with Argon2.

  • Authentication

    • Multi factor authentication, sessions and device records on every account.
    • API keys for machine access, scoped and revocable.
    • An ephemeral key is generated per user signature and destroyed after use.

  • Authorization

    • Roles and permissions down to the individual object, not just the workspace.
    • Authorization policies are centralised rather than scattered across features.
    • Scopes and delegations record on whose behalf an action was taken.

  • Data protection

    • Organization isolation is enforced by PostgreSQL row level security, in addition to the application filter.
    • Tables carry FORCE ROW LEVEL SECURITY; the application role cannot bypass it.
    • Public verification is served by a read only role that sees only what may be shown.

  • Audit

    • An append only log: SQL permissions and a database trigger refuse update and delete.
    • Entries are Merkle chained, so removing one breaks the chain visibly.
    • Checkpoints are sealed and anchored to a public ledger.

  • Key management

    • Six usages, six distinct keys; no key is reused across two purposes.
    • Signing keys live in a managed key service and are non exportable.
    • Key versions are tracked logically, so an old signature stays verifiable after rotation.
    • The certificate authority root is kept offline, never in the production key service.

  • Infrastructure

    • The hosted edition runs in France today, outside the Cloud Act.
    • A WAF, DDoS mitigation and rate limiting sit at the edge.
    • The edge sees no content in clear: it terminates requests, not documents.

  • Data residency

    • Deploy where your law applies: on your own infrastructure, with a hosting partner in your country, or inside an isolated network.
    • Deployment options are rolling out with early access.
    • The hosted edition runs in France today; data region is an attribute of your organization.

  • Compliance

    • In place: RFC 3161 electronic timestamps, C2PA provenance manifests, OpenTimestamps anchoring, GDPR erasure that keeps the proof.
    • In progress: a contract with a qualified timestamp provider, C2PA conformance, and legal review of advanced signature levels.
    • Nothing on this site claims a certification that is not in place.

  • Incident response

    • [PROCESS] — the incident response process is being written and will be published here.
    • The notification deadline is the one the law applicable to the deployment concerned imposes.

  • Responsible disclosure

    • Report a vulnerability to security@iron-id.io.
    • We acknowledge within two business days and will not pursue good faith research.

For the cryptographic detail, read the technology page. For the legal documents, open the trust center.

TechnologyTrust center

Get started

See IRON ID for your organization.

Request a demo of the Platform, join early access to be onboarded in the first cohorts, or request a quote for a KYC or Sign SDK integration.

Request a demoRequest a quote

Reply within two business days · contact@iron-id.io