Truvee
01Security

Built for trust. Engineered for privacy.

Truvee takes security seriously because the whole product exists to solve trust problems. Here is exactly how your data is protected.

01

Built on Stripe

  • Live face verification is powered by Stripe Identity, the same biometric verification platform used by major banks, marketplaces, and fintech companies.
  • Payments and billing run on Stripe (PCI DSS Level 1). Truvee never sees, stores, or transmits raw card numbers.
  • Stripe processes biometric data under its own privacy controls and certifications. Truvee receives only the verification result, never the raw faceprint or biometric template.
02

Verification infrastructure

  • Identity verification uses Stripe Identity's live face verification, the same kind of stack used by regulated financial institutions.
  • Biometric data (faceprints) is processed and stored by Stripe, not Truvee. We never receive raw biometric templates.
  • Document OCR, tamper detection, and face matching use Stripe's machine-learning models plus manual review on edge cases.
03

Data in transit

  • All traffic encrypted with TLS 1.3.
  • HSTS enforced sitewide for truvee.net.
  • Every Stripe webhook is cryptographically verified against Stripe's signing secret. Unsigned payloads are rejected.
04

Data at rest

  • PostgreSQL encrypted at rest.
  • Sealed PDFs and ID-photo references stored in AWS S3 with server-side encryption (SSE-S3).
  • Passwords hashed with bcrypt at cost factor 12.
05

Access controls

  • Role-based: user, founder, admin.
  • Every admin action logged to an immutable audit table.
  • All sealed-PDF download links are signed and expire in 30 days.
  • ID-photo links are watermarked and expire in 30 days.
06

Identity & biometric data

  • Government-ID copies are retained in the private PDF with recipient consent; authorized requester and recipient access is required.
  • Live face verification is processed by our identity provider during the 60-second verification window per their security and privacy policies.
  • Truvee receives only the structured result (verified name, document type, match status) and the sealed PDF.
07

Payment security

  • All payments processed by Stripe, a PCI DSS Level 1 certified payments provider. Truvee never stores card numbers.
  • PCI DSS compliance inherited through Stripe.
08

Operational practices

  • Secrets stored encrypted, never in source control.
  • Database backups run nightly, retained 30 days.
  • Incident response: 24-hour internal notification, 72-hour external notification where required by law.
09

Your rights

  • Request a copy of your data, request deletion, or report a security concern at sales@truvee.net.
  • We respond within 5 business days.