How we protect your data.
Authentiq handles data about how real people reach your platform. This page sets out how we protect it and how to report a security issue.
What you get.
Encrypted in transit
Every connection runs over HTTPS with TLS 1.2 or newer, and plain HTTP is redirected. The SDK also encrypts its identification request before it leaves the browser.
EU and US data residency
Choose where your data is stored: in Europe or in the United States.
No PII required
Authentiq scores visits without names, email addresses or phone numbers.
Signed callbacks
Every screening callback carries an HMAC-SHA256 signature and a timestamp, so your server can reject forged or replayed calls. Each account has its own signing secret.
Found a vulnerability?
Tell us before anyone else. Reports cover authentiq.io and its subdomains, the browser SDK and the API. There is no paid bounty yet.
security@authentiq.ioHow to report
- Email the steps to reproduce and the impact you expect.
- Use only your own accounts and data. Never access anyone else’s.
- No denial-of-service and no high-volume automated scans.
- Give us reasonable time to fix it before you publish.
What we do
- Confirm we received your report.
- Keep you updated until it is fixed.
- Credit you once it is fixed, if you want.
- Take no legal action over good-faith research that follows these rules.
Reviewing us as a vendor?
Send your security questionnaire to the same address. We answer every question, including the ones where the answer is “not yet”.
Email the security team →