Security

How we protect your data

VerifiedFast handles sensitive professional and identity verification data. Security is foundational to everything we build.

API Key Security

  • API keys are generated using cryptographically secure random bytes
  • Keys are hashed with SHA-256 before storage — we never store plaintext keys
  • All API requests require authentication via Authorization header
  • Keys follow the format rk_<base64url-random> for easy identification

Data Encryption

  • All API traffic is encrypted with TLS 1.3
  • Database connections use encrypted channels
  • Verification data is stored in PostgreSQL with access controls
  • ID verification images are processed in memory and never persisted to disk

ID Verification Privacy

  • Government ID photos and selfies are processed in real-time and immediately discarded
  • Only SHA-256 hashes of images are stored for audit purposes
  • Face matching is performed by OpenAI vision analysis — no biometric templates are created or stored
  • Verification sessions expire automatically (default: 24 hours)
  • Consumers can delete verification sessions at any time via the API

SMS Verification

  • OTP codes are hashed with SHA-256 before storage
  • Codes expire after 10 minutes by default (configurable up to 30 minutes)
  • Phone numbers are stored only for the duration of the verification session
  • Rate limiting prevents brute-force attempts

Infrastructure

  • Application runs on dedicated infrastructure, not shared hosting
  • SSH access requires key-based authentication only
  • UFW firewall restricts access to essential ports (22, 80, 443)
  • Fail2ban monitors and blocks suspicious login attempts
  • PM2 process manager ensures automatic restart on failure

Data Handling

  • Verification queries are logged for billing and debugging — they are not sold or shared
  • License verification results are cached for 90 days, then refreshed on next request
  • We query only publicly available licensing registries and databases
  • Raw API responses from upstream sources are stored for audit trail

Compliance

  • VerifiedFast retrieves only publicly available information from government registries
  • Our Privacy Policy details how we handle data under CCPA and GDPR frameworks
  • We do not make employment decisions — our data is informational only
  • Users are responsible for ensuring their use complies with applicable laws (FCRA, etc.)

Report a vulnerability

If you discover a security vulnerability, please report it responsibly by emailing [email protected]. We take all reports seriously and will respond within 24 hours.