Privacy and security
Built to share less, not more.
What we hold
Your name and email, the claims you enter, verifier responses (name, role, email domain, fields confirmed, date), share links and an audit trail. We do not store identity documents, certificates or any uploaded files.
Links
Verification and share links carry 256 bits of randomness. We store only a SHA-256 hash, so a database copy cannot be turned back into working links. Verification links are single-use and expire after 14 days. Pages behind links are not indexed and send no referrer.
Sharing
Each link shows only the claims you selected. Links expire after the period you choose and can be revoked at once. You can see how many times each link was opened. Recipients never see your email or your verifiers’ email addresses.
Sign-in
No passwords. A 6-digit code is emailed to you, expires in 10 minutes, allows five attempts and works once. Sessions are signed, HTTP-only cookies.
Access
All data sits behind server-side checks: the database refuses every direct client request, and each API call is tied to your signed session or to a hashed link token. Sign-in, requests, verification and reporting are rate-limited.
Audit trail
Every status change is an append-only event with a time, the actor (you, the verifier, a recipient, or the system) and the engine version. Corrections and disputes are added to history, never written over it.
Your rights
Download everything we hold as JSON from your passport. Delete your account and every claim, confirmation, link and history entry is removed in one step. Requests under GDPR: support@connectprove.com.
AI
No AI decides whether a claim is verified, and none is involved in the verification engine. Statuses come from deterministic rules and the verifier’s answer.