Security, compliance and data sovereignty

We only claimwhat is in place.

Each measure is published with its real state: in place, in progress, not claimed. The published pages mention neither ISO 27001, nor SOC 2, nor SecNumCloud, nor HDS, because none of these certifications is in place today.

Published technical measures

Encryption

AES-256-GCM at rest, envelope encryption; a distinct key per version, wrapped by a key management service that never receives the content. The edge terminates requests, not documents.

Identity

Accounts, organizations, members, roles, API keys; human and machine identities on the same life cycle; X.509 certificates; passwords hashed with Argon2.

Authentication

MFA on every account; registered sessions and devices; scoped, revocable API keys; an ephemeral key destroyed after each signature.

Authorization

Permissions down to the individual object; centralized policies; delegations that record on whose behalf an action is taken.

Data isolation

PostgreSQL Row-Level Security in FORCE, on top of the application filter; public verification through a read-only role.

Audit

Append-only log; entries chained by a Merkle tree; checkpoints sealed and anchored in a public ledger.

Key management

Six key uses, each with its own; non-exportable signing keys; the certificate authority root kept offline.

Infrastructure

Application firewall, DDoS mitigation and rate limiting at the edge; production finalized for 20 November 2026.

People

Contractual confidentiality, access limited to what the task needs, named and logged access to production.

Data residency

Where the customer's law applies.

Data of French and European customers hosted in France, under European law. French host announced before 20 November 2026. Any change of sub-processor comes with 30 days' notice and a right to object.

CustomersLocationHost

France and EUFrance, under European law (from 20 November 2026)French host announced before 20 November 2026

Other countriesIn the customer's country according to demand, or on its infrastructure on quotationSet in the quotation; where relevant, a national hosting partner

Compliance status

In place

RFC 3161 electronic timestampsSigned C2PA provenance manifestsOpenTimestamps anchoring on BitcoinChained audit log with sealed checkpointsGDPR erasure that preserves the proofPublic evidence bundle, verifiable offline

In progress

Contract with a qualified timestamp providerC2PA conformance with a trust list authorityLegal review of the advanced electronic signature level

Not claimed

ISO 27001SOC 2SecNumCloudHDSQualified timestampeIDAS qualified signature

Responsible disclosure

One address, an acknowledgment within two days.

Report vulnerabilities to security@iron-id.io: acknowledgment within two working days, no legal action against good-faith research, the reporter kept informed until the fix, and optional public credit.

For prospects: architecture presentation, threat model review, verification demonstration on their own files.

Detection and triage

A person triages each alert and decides whether it is a security incident.

Containment

Access revoked, secrets rotated, services isolated if necessary.

Notification

Affected customers and the competent authority informed within the time set by applicable law; under the GDPR, 72 hours for the supervisory authority.

Report

Post-incident report delivered to affected customers.