Trust & Platform Integrity
Security & Trust
IdentiQ operates on a Zero Trust foundation to guarantee that every NFC tap, QR scan, and digital business card transaction is secure.
Data Encryption
How we secure your data in transit and at rest.
- In Transit: All data transmitted between user devices and our servers is encrypted using TLS 1.3 with strong cipher suites.
- At Rest: Database volumes, lead databases, and user metadata are encrypted using AES-256 with automatically rotated master keys.
- Passes & QR Codes: Verification tokens generated for NFC taps are signed cryptographically with ECDSA algorithms, rendering them tamper-proof.
Authentication Methods
Robust mechanisms to ensure secure user authentication.
- Social Sign-in: OAuth 2.0 via Google utilizes PKCE (Proof Key for Code Exchange) to prevent intermediate credential interceptions.
- Credentials Security: All password-based accounts are secured using Argon2id or bcrypt key-derivation functions with salt generators.
- Session Limits: Inactive sessions are set with absolute timeouts (COOKIES_TTL), requiring periodic re-validation.
Infrastructure & Network
Cloud safeguards shielding the core API and servers.
- Edge Hosting: Hosted on Vercel's multi-region serverless platform, ensuring high availability and protection against single-point failures.
- DDoS Mitigation: Integrated network firewalls automatically detect and drop malicious layer 7 request floods.
- IP Access Auditing: Super Admin controls are protected behind stringent IP filters and absolute access logs.
Data Isolation & Storage
Ensuring individual data privacy and tenant separation.
- Row-Level Security: PostgreSQL database schemas on Supabase enforce Row-Level Security (RLS) on all user-facing queries.
- Data Hygiene: Lead contact lists collected via NFC taps are only accessible to card owners, locked behind JWT access privileges.
- Database Backups: Encrypted hourly database snapshots are retained for 30 days to guarantee quick recovery in emergency incidents.
Privacy Commitments
We believe your profile analytics, leads data, and business card interactions belong solely to you. IdentiQ strictly operates on privacy-by-design standards:
- No Tracking: We never sell card metrics, profile metadata, or NFC telemetry to third-party ad brokers.
- GDPR & CCPA Ready: You can completely export or delete all of your account logs, card analytics, and organization settings instantly.
- Sovereign Leads: Lead contacts acquired by guests scanning your cards are stored locally in secure databases and are not used for platform marketing.
Responsible Disclosure
We appreciate the security community's work in keeping the internet safe. If you discover a vulnerability or potential leakage within our card logic, we ask that you report it to us responsibly.
Vulnerability Reporting Guidelines:
- Email your findings directly to hello@saurabhdey.in.
- Provide proof-of-concept steps to replicate the bug.
- Allow 48 hours for our engineering team to audit and patch the issue before publishing details.