Enterprise security
Controls designed around verifiable records.
Current architecture statement · 15 August 2026
Data protection
Production records are stored in managed PostgreSQL over TLS. Private evidence is separated from public record data and encrypted with AES-256-GCM. Evidence and public payloads receive SHA-256 hashes.
Integrity and auditability
Certificates are signed with Ed25519. Public verification recomputes the payload and evidence hashes. Audit events are hash chained, signed and protected by database triggers that reject updates and deletions.
Access and operations
Customer access supports passwordless authentication, organization roles and revocable API keys. Secrets are stored outside source control. Rate limits, connector timeouts, retries, source-health tracking, lifecycle controls and webhook signing reduce operational and abuse risk.
Enterprise disclosures
Proof Rail does not currently claim SOC 2, ISO 27001, PCI DSS or another independent certification, and no default uptime SLA is represented. Data residency, retention, subprocessors, incident notification, penetration testing and contractual SLAs are documented during Enterprise review before production approval.