Information Security

Our commitment

Senly ID handles some of the most sensitive information there is: identity documents and verification results. Security is designed into the platform, not bolted on. This page summarises the controls we operate. It describes our posture and is not a warranty; it should be read with our Privacy Policy.

Data minimisation and process-and-purge

The strongest protection is not holding data you do not need. Senly ID follows a process-and-purge rule: once a verification result is captured and cryptographically signed, the raw verification session, including document images, is deleted at the verification processor. We keep the outcome (a signed result) and only the attributes a consumer chooses to retain in their vault. We do not store raw identity documents.

Encryption

• At rest: sensitive vault attributes are encrypted with AES-256-GCM. Encryption keys are managed in a hardware-backed key-management service (AWS KMS); a separate key wraps per-user data-encryption keys, and application code never handles raw key material.
• In transit: all traffic is protected with TLS, with HTTPS enforced end-to-end.

Tenant isolation and access control

• Row-level security is enforced on every database table, so one business or user can never read another’s data.
• Every request is authenticated and authorised to the caller’s own resources (organisation-scoped for businesses, account-scoped for individuals); privileged actions require the appropriate role.
• A consumer’s identifier is pseudonymised per business so the same person cannot be silently correlated across different businesses.

Tamper-evident, re-verifiable records

Every verification outcome is cryptographically signed (ES256) with a key held in the key-management service. Anyone can independently confirm a result is genuine and unaltered by re-checking its signature against our public keys, and a superseded or revoked result is reflected through a published revocation list. Change any detail of a record and the signature breaks.

Secure integrations

• Inbound webhooks are signature-verified (HMAC) with replay protection, so results cannot be spoofed.
• Card payments are handled entirely by our PCI-compliant payment provider on their hosted page. We never see or store card numbers.
• Our verification providers are independently certified to recognised standards, including SOC 2 (Type 1), ISO/IEC 27001:2022, and iBeta Level 1 presentation-attack detection (ISO/IEC 30107-3) . Australian government-document checks run against the official Document Verification Service through a gateway provider authorised on the Australian Government’s approved list.

Software supply chain

Dependencies are version-pinned and lock-file-frozen; every change runs an automated security audit and a static code-analysis scan before it can be released, and deployments run only after these checks pass. We do not auto-adopt new dependency versions; security fixes are reviewed before they are applied.

Availability and recovery

The platform runs on managed cloud infrastructure in Australia (Sydney), with health checks that automatically roll back a release that does not come up cleanly. Database schema changes are applied in a controlled, idempotent sequence ahead of each deployment.

Data breach response

We maintain a response process aligned to the Australian Notifiable Data Breaches scheme. If an eligible data breach that is likely to result in serious harm occurs, we will contain and assess it, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required, and take steps to prevent recurrence.

Reporting a vulnerability

If you believe you have found a security issue, please contact us at security@senly.ai. We appreciate responsible disclosure and will work with you to resolve genuine issues.