Security & Trust
Last updated: June 2026
How we protect your data and operate the Service. For independent, on-chain verification of proofs, see the Transparency page.
Account & data security
- All traffic is served over HTTPS/TLS; authentication uses Secure, HttpOnly cookies.
- Passwords are stored as bcrypt hashes; API keys are stored only as hashes.
- Optional two-factor authentication (TOTP) and a recent-login history on every account.
- Per-account and per-IP rate limiting and durable error logging.
- Files are hashed in your browser — for file anchoring, the file itself never leaves your device.
- Outbound requests (web capture, webhooks) are SSRF-protected (internal addresses are blocked).
Integrity & verifiability
- Each proof is anchored on a public blockchain (Base) and is tamper-evident from the moment of capture.
- The anchoring contract is open-source and verified on-chain; anyone can read it.
- Proofs are independently verifiable with our open-source verifier — no trust in ChainAnchor required.
Your controls
- Export all your anchors at any time, and delete your account (removing personal data) from your account page.
- Organizations have role-based access and an activity/audit log of administrative actions.
Sub-processors
We share data only with the providers needed to run the Service:
| Provider | Purpose |
|---|---|
| Cloud / VPS host | Application and database hosting |
| Email delivery (Mailjet) | Transactional email (verification, alerts, invites) |
| Blockchain RPC provider (e.g. Alchemy) | Reading from / writing to the blockchain |
| Base (public blockchain) | The public, permanent anchor record (hash + timestamp only) |
This list may change as the Service evolves; material changes are reflected by the date above.
Compliance posture
We support core data-protection rights (export, deletion, correction) and follow security best practices described above. Formal certifications (e.g. SOC 2, ISO 27001) are on our roadmap rather than completed today; we’re happy to discuss our practices with enterprise customers.
For enterprise & procurement
- Security FAQ — answers to common security & procurement questions.
- Data Processing Agreement (DPA) — GDPR Article 28 template for organizations.
Reporting a vulnerability
Found a security issue? Please email contact@chainanchor.io with details. We appreciate responsible disclosure and will respond promptly.