TrustNet
Print / Save PDF
Trust Center · Draft

Security / Trust Center

A summary of the controls that keep identity data out of the wrong hands: encryption, least privilege, an auditable disclosure trail and a disclosure route for researchers.

Document: TrustNet-Security-v0.1 Version: 0.1 Updated: 2026-10-21 Status: Draft — no certifications claimed Audience: RP operators, DPOs and security teams
Print / Save PDF Report a vulnerability

1Architecture

TrustNet is an identity orchestration layer over standard OIDC. Ory Hydra issues tokens, Ory Kratos holds the account and login credentials, persona-api applies the consent and disclosure rules, and the SPA renders the user surface. Administrative Hydra/Kratos APIs are backend-only and are never exposed to the browser.

2Encryption and keys

  • Attribute values are envelope-encrypted with Vault Transit before they reach the personas database.
  • Lookup-by-value uses HMAC blind indexes; plaintext values are not indexed.
  • The PPID salt and signing keys live in Vault, never in code, config, logs or error messages.
  • Object storage uses provider-managed server-side encryption.
  • Account erasure destroys the account's wrapped data key (crypto-shredding) in addition to deleting the PII stores.

3Access control

  • Least-privilege operator access; administrative surfaces are separate from the first-party and machine planes.
  • RP-facing tokens are opaque, and each RP is configured for pairwise subject identifiers.
  • Destructive operator actions are audited and gated; self-service account deletion requires a fresh login or AAL2 when MFA is enabled.
  • Secrets are read from Vault at boot; a missing or malformed secret fails the boot rather than degrading silently.

4Audit trail

Consent and disclosure events are append-only, written to per-RP trees and a system tree, hashed into a Merkle log and committed with signed tree heads and periodic anchors. Leaves carry claim names and proofs, not claim values. Erasure removes the erasable correlation rows and keeps the PII-free skeleton.

5Secure development

  • Security invariants are written down and enforced by tests and guard rails.
  • Schema changes go through versioned migrations; administrative APIs remain backend-only.
  • Uploaded files are scanned before they are served; pictures use short-lived signed access.
  • Dependencies are pinned, and the CI pipeline runs unit, frontend and end-to-end checks.

6Incident response

Incidents are triaged, contained and recorded. A personal data breach is assessed against the 72-hour notification rule and, where required, notified to the supervisory authority and affected individuals. RP operators are notified without undue delay where their data is affected.

7Data residency and subprocessors

The service and its processors are hosted in the EEA. The current processor list and transfer position are on the Subprocessors page.

8Certifications

TrustNet does not claim ISO 27001, SOC 2 or any other certification it does not hold. This page describes controls, not a certified management system.

9Contact and disclosure

Security contact: privacy@trustnet.app. Report a vulnerability through the vulnerability disclosure page; the machine-readable policy is in /.well-known/security.txt.