Built for enterprise security requirements.

No keystroke storage

Raw key presses are never recorded. Only timing statistics (IKI mean/std) are computed locally and discarded.

No coordinates stored

Mouse positions are never stored. Velocity and curvature are computed on-device and immediately discarded.

Feature vectors only

Only the 34-dimensional vector leaves the device. It cannot be reverse-engineered to recover raw inputs.

GDPR compliant

CertiLayer is architected to minimize personal-data collection and support GDPR privacy requirements.

CCPA compliant

No personal data is sold or shared. Privacy controls are built into the architecture from the ground up.

SOC 2 ready

Audit logs, access controls, and the Merkle ledger provide the evidence trail required for SOC 2 readiness.

BLAKE3 key hashing

All API keys are stored as BLAKE3 hashes. A database breach cannot directly expose working keys.

Merkle audit trail

Every HCS score is committed to a Merkle Tree, tamper-evident by construction. Customer-facing proof export is on the roadmap.

Replay protection

Every ingestion request includes a nonce using Redis SET NX EX. Replays are rejected at the L2 Gateway.

Key pair separation

Public keys for SDKs (pk_) and secret keys for servers (sk_) use separate scopes and attack surfaces.

Signed CBDU payloads

All Certified Behavioral Data Units are BLAKE3 signed. Tampered payloads are rejected during ingestion.

Session TTL enforcement

Sessions expire automatically through Redis TTL. Stale sessions cannot be replayed for access.