Security
Security, stated plainly
OptProof holds the evidence of your customers’ choices, so we treat it like evidence. This page says what we do now, what happens before launch, and what we have not done yet.
Security
Where we stand today
What we do today, what happens before launch, and nothing we have not done.
- By design
Stored in India
Our database, files and backups live in AWS Mumbai (ap-south-1). Backups stay in the same region.
- By design
Encrypted
TLS everywhere. Phone numbers, emails and connector credentials are encrypted at rest with envelope keys.
- By design
Append-only ledger
Consent events, receipts and anchors cannot be edited or deleted, by the database itself. Corrections are new events.
- By design
Verifiable receipts
Every event is hash-chained, signed and anchored daily in write-once storage. The method is published.
- By design
Minimal data in the proof
Receipts carry no names, phone numbers or emails. The ledger stores a keyed pseudonym, not the identifier.
- Before launch
Independent security test
An external VAPT before public launch, with high and critical findings fixed before we open sign-ups.
How we protect data
Where data lives
- OptProof runs on one server in AWS Mumbai (ap-south-1) (Amazon Lightsail). The database (Postgres) and the job queue (Redis) run on that server.
- Every night the database is backed up, encrypted, to Amazon S3 in Mumbai. Backups stay in India.
- Consent evidence (daily anchors) is written to Amazon S3 in Mumbai with Object Lock in compliance mode: nobody, including us, can overwrite or delete it during the retention period.
- Two things leave this setup. Email goes through our email provider, Hostinger, which stores mail in the European Union (France or Germany). AI features send text to Anthropic outside India, after names, phone numbers and emails are removed.
Encryption and keys
- HTTPS on every OptProof domain, with HSTS and certificates from Let’s Encrypt.
- Phone numbers, email addresses and connector credentials are encrypted at rest with envelope encryption (AES-256-GCM under AWS KMS).
- Secret API keys are shown once and stored only as argon2id hashes. Keys can be rotated with an overlap window.
- Receipt signing keys live in AWS Secrets Manager in Mumbai. Public keys, including retired ones, are published forever so old receipts keep verifying.
The consent ledger
- Consent events, receipts, anchors, audit logs and access logs accept inserts only. Database triggers and revoked privileges block updates and deletes.
- Each event is hash-chained to the one before it, so a change anywhere breaks every hash after it.
- The verification method and test vectors are published, so anyone can check our records with their own code.
Less personal data, by default
- The ledger stores a keyed pseudonym of each person (an HMAC with a per-customer secret), never the raw phone number or email.
- Receipts contain no names, numbers or emails.
- Application logs redact phone numbers, emails, names, IP addresses and tokens before they are written.
- Before any AI model sees text, identifiers are replaced with placeholders. Every AI draft goes to a person for approval.
Access control
- Every customer table is protected by Postgres row-level security, and each repository has an automated cross-customer leak test.
- Roles for owners, admins, DPOs, front-desk staff and viewers. Two-factor sign-in is mandatory for workspace owners.
- When OptProof support needs to look at a workspace, they must give a reason, access lasts 30 minutes, a banner shows it, and every action is audited.
Assurance
Where we are, without rounding up.
External penetration test (VAPT)
Planned before launchAn independent firm tests the API, console, portal and widget before public launch. We fix every high and critical finding before opening sign-ups and will publish a summary.
Availability
One server todayOptProof runs on a single server with nightly backups. There is no standby server or automatic failover yet, so a server fault means downtime while we restore it. The uptime figures on our pricing page are targets, and we will add servers as customers grow.
Dependency and container scanning
In placeAutomated dependency updates, package audits and container scans on every change.
Security whitepaper
Before launchA longer description of our architecture and controls for security reviewers.
ISO 27001
On the roadmapWe hold no security certifications today. We plan to work towards ISO 27001 after launch.
Retention of evidence
By default we keep consent evidence for 7 years and processing logs for at least 1 year. Customers can configure retention per purpose. These are product defaults that we are confirming with counsel.
Report a vulnerability
If you find a security issue, email security@optproof.in with the steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else. We will reply within two working days.
Start with test keys today. Go live when you’re ready.
Install the widget, record test consents and verify your first receipt in under ten minutes.