Security
A minimal attack surface by design.
Zero file custody
VerixID does not store the files it verifies. Only the cryptographic fingerprint and the registration metadata are persisted. This eliminates an entire class of risks associated with file storage: data breaches, unauthorized access, retention liability, and confidentiality exposure.
Cryptographic verification
Verification relies on SHA-256 for fingerprinting and on cryptographic signatures for registration records. Neither depends on trust in a central authority at verification time — only on the mathematics of the hash function and the signature scheme.
Tamper-evident records
Once a registration record is signed, any modification to the record invalidates the signature. This makes it computationally infeasible to alter a registration after the fact without detection.
Integrity model
| Property | Mechanism |
|---|---|
| File identity | SHA-256 |
| Record integrity | Digital signature |
| Time anchoring | Timestamp |
| Verification | Deterministic recomputation |
Attack surface
Because files are never stored, the most sensitive data — the contents of user files — is never present on VerixID infrastructure. The remaining surface consists of fingerprint metadata and registration records, which are designed to be public and verifiable.
Signing
Registration records are signed using modern elliptic-curve cryptography. Signing keys are managed under strict operational controls, and the verification path is designed to be independent of the signing infrastructure.
Infrastructure principles
- Minimal data retention.
- No file storage under any circumstances.
- Verification that does not require trust in the operator.
- Public, auditable verification logic.
For the canonical security policy and any legal disclosures, see verixid.com/security.
Frequently Asked Questions
Does VerixID store user files?
No. VerixID operates on a zero-custody model. Files are never uploaded, stored, or retained. Only the SHA-256 fingerprint and registration metadata are persisted. This eliminates an entire class of risks associated with file storage, including data breaches, unauthorized access, retention liability, and confidentiality exposure.
How does VerixID make registration records tamper-evident?
Registration records are cryptographically signed. Once a record is signed, any modification to the record invalidates the signature. This makes it computationally infeasible to alter a registration after the fact without detection.
What is VerixID's attack surface?
Because files are never stored, the most sensitive data, the contents of user files, is never present on VerixID infrastructure. The remaining surface consists of fingerprint metadata and registration records, which are designed to be public and verifiable. This minimizes the impact of any potential compromise.
What cryptographic algorithms does VerixID use?
VerixID uses SHA-256 for file fingerprinting and modern elliptic-curve cryptography for signing registration records. Verification is deterministic and does not require trust in the operator at verification time; it relies only on the mathematics of the hash function and the signature scheme.
How are signing keys managed?
Signing keys are managed under strict operational controls. The verification path is designed to be independent of the signing infrastructure, so that verification does not depend on the availability or integrity of the signing system at verification time.
Is verification dependent on trust in VerixID?
No. Verification relies on SHA-256 for fingerprinting and on cryptographic signatures for registration records. Neither depends on trust in a central authority at verification time, only on the mathematics of the hash function and the signature scheme.
What infrastructure principles does VerixID follow?
VerixID follows minimal data retention, no file storage under any circumstances, verification that does not require trust in the operator, and public, auditable verification logic.
Where can I find the canonical security policy?
The canonical security policy and any legal disclosures are published at verixid.com/security. The technical authority site at verixid.github.io provides the technical context and architecture overview.