Security at Signetify

Security is foundational to Signetify. This page summarises the controls protecting your data and the platform.

Encryption

• TLS 1.3 in transit; service-to-service authentication.
• AES-256-GCM encryption at rest for sensitive stores.
• Post-quantum-ready key management (ML-KEM-768 + ML-DSA-65) with attestation-gated key release — keys are unwrapped only inside the custody boundary.

Access control & identity

• Role-based access control with server-derived tenant isolation on every surface.
• Multi-factor authentication (TOTP + WebAuthn) with backup codes.

Auditability

• Tamper-evident, hash-chained audit trail across security-relevant events.
• Every administrative mutation is recorded.

Supply chain & vulnerability management

• Pinned dependencies, lockfile enforcement, and automated dependency/advisory scanning.
• Code scanning (CodeQL) and a silent-bug audit gate in CI.
• Regular penetration testing.

Responsible disclosure

Found a vulnerability? Please report it privately to security@signetify.com. We acknowledge reports promptly and will keep you updated through remediation. Please do not publicly disclose before we have had a reasonable opportunity to respond.