Legal and security
Everything a company needs to read, or to give its lawyers, before building on IRLProof. Last updated 15 September 2026.
Documents
What we promise, what we do not, what a sign-in does and does not say, and what a site agrees to. Draft.
What is read from an ID, that none of it is kept, what is kept for a site and for how long, and what can never be produced because it is not stored. Draft.
Data processing agreement
Not written yet. Ask at privacy@irlproof.me and we will work from your paper or ours.
Security questionnaire
No certification yet, and we will not imply one. Send yours and we will answer it honestly.
How the service is built, in security terms
- Identity dataNo name, date of birth, address, document number or photo is written anywhere, and no record of a person exists here. A site's identifier is computed from the ID at every sign-in and stored by the site alone. See the privacy policy.
- In transitHTTPS everywhere, with the sign-in flow ending at addresses each site registers in advance.
- At restEncrypted. The key that turns an ID into a site's identifier is held in a separate managed key store, not in the application database.
- Key rotationToken signing keys are rotated through a deliberate, logged procedure, with previous keys retained so nothing already issued stops verifying. The identifier key is not rotated: nothing stored could be recomputed under a new one, and that is the point of it.
- SeparationEach site receives its own identifier for a person, so two sites cannot compare their users, and a breach of one tells an attacker nothing about another.
- Console accessOrganizations, roles, and an activity log naming who changed what. See Developer docs.
- Wallet programIDs from Google Wallet are presented under Google's digital identity program, which requires each site to be notified to Google and allows Google to require a site's sign-ins to stop. What that means for a site is in the terms.
Who else is involved
The service runs on Microsoft Azure (application, database, secrets), sends email through Azure Communication Services, and uses Cloudflare for DNS. Credential verification runs in our own deployment of OpenCred, the open-source verifier from the California DMV and Digital Bazaar. No advertising or analytics vendor receives anything derived from an ID.
Reporting a security problem
Email privacy@irlproof.me with "security" in the subject. Tell us what you found and how to reproduce it. We will reply, and we will not threaten you for telling us.