§ Trust

What we can prove.

Trust is a list of verifiable facts, not a marketing claim. The page below documents what is in production today, what is in flight, and what is deferred. Where a control is not yet shipped, it says so.

§ 01 — Identity

Identity and access.

  • Four sign-in methods — email magic link, Google OIDC, phone OTP, Solana SIWS.
  • Step-up authentication for sensitive actions (payouts, KYC, key rotation).
  • Active session list with per-device revocation, accessible from every account page.
  • Three KYC tiers — T1 phone, T2 ID + liveness, T3 reputation — backed by Sumsub.
§ 02 — Integrity

Data integrity.

  • Append-only audit chain. The audit_events, ledger_entries, and payouts tables are sha256-chained in Postgres.
  • Mutation rejection at the database trigger layer — append-only is enforced by the database, not by the application.
  • Single-scan tamper detection. Any in-place row edit breaks the chain hash and is detectable end-to-end.
  • Every consequential action — sign-in, payout, role change, dataset publish, dispute outcome — writes to the audit chain.
§ 03 — Privacy

Privacy rights.

  • GDPR Art. 15 right of access — GET /api/me/export returns the full user record as portable JSON.
  • GDPR Art. 17 right of erasure — POST /api/me/erase tombstones the account and detaches per-label receipts.
  • Consent receipts. Every Terms, Privacy, and DPDP acceptance is versioned and timestamped per user.
  • Data Processing Addendum (DPA) available on request for Builder accounts.
§ 04 — Operations

Operational posture.

  • Sentry + OpenTelemetry → Grafana Cloud. Errors and traces in one queryable surface.
  • FingerprintJS Pro for Sybil resistance and device clustering across the qualified pool.
  • WCAG 2.1 AA target. axe-core runs in CI on every marketing and product build.
  • Virtual-thread Tomcat (Project Loom). Per-request thread-per-task with kernel-thread pooling.
§ 05 — Roadmap

What we're working toward.

In progress

SOC 2 Type II

Evidence collection in progress; attestation expected within N months of launch.

Deferred

HIPAA clean-room compute

Phase 1.1 (post-launch follow-up).

§ 06 — Disclosure

Security disclosure.

We run a coordinated vulnerability-disclosure process. Reports go to security@humaniti.io, encrypted with our published PGP key. Eligible scope covers production surfaces under humaniti.io. Out of scope — third-party vendor surfaces, denial-of-service findings, and reports depending on social engineering of staff. Acknowledgement within two business days; triage within five.

§ 07 — Subprocessors

Subprocessors.

The vendors below process data on behalf of the Network. DPAs are available on request.

Sumsub
KYC + liveness checks for T2 and T3 verification.
Twilio
Phone OTP delivery for T1 verification.
FingerprintJS
Device fingerprinting and Sybil resistance.
Mailgun
Transactional email — magic links, receipts, notifications.
Cloudflare R2
Blob storage — task assets, exports, signed receipts.
Mongo Atlas
Application data — users, orgs, projects, tasks, annotations.
Postgres host
Audit + financial data — audit_events, ledger_entries, payouts.
Sentry
Error tracking and performance traces.
Grafana Cloud
Metrics, logs, and OpenTelemetry traces.