Open by design.
Verifiable by default.

• Data in transit is protected with TLS 1.2+ (HSTS on production hosts).
• Data at rest is encrypted with AES-256 in object storage and managed database.
• Certificate signing uses HMAC-SHA256 with a server-only key rotated periodically.
• Session tokens are HttpOnly, Secure, and SameSite-scoped cookies.

• Passwords are hashed with bcrypt using a per-user salt.
• API keys are scoped, revocable, and displayed only once at creation.
• OAuth 2.0 authorization codes are single-use with a 60-second TTL.
• Access to your files is restricted to your own account by default.

• File bytes are stored in object storage; metadata lives in a separate managed database.
• Hashing and timestamping happen server-side before any downstream processing.
• AI processing runs in a separate execution path and cannot mutate evidence records.

• Every mutation is logged with actor, timestamp, and action.
• Audit logs are append-only and cannot be edited via the application.
• Full audit history is included in every Evidence Package export.

Cryptographic evidence — hashes, timestamps, certificates, and audit logs — is retained for the lifetime of your account. If you delete your account, private evidence is removed but certificates you have previously published remain publicly verifiable so third parties who received them can still validate their integrity.

Government IDs and selfies submitted for identity verification are stored in restricted-access storage and purged automatically after admin review completes (typically within 24 hours). Only the verification decision, the reviewer, and the timestamp are retained.

Rolling database snapshots are retained on a short window (7–30 days) for disaster recovery. Backups are encrypted and inaccessible from the application layer.

Files deleted from your vault are soft-deleted immediately (hidden from all views), then hard-deleted from object storage on the next retention sweep. Deleted files cannot be restored via self-service — contact support within 7 days if you deleted something by mistake.

Report vulnerabilities to security@chroniq.io. We acknowledge within 2 business days and coordinate disclosure with the reporter.

Reported issues are triaged by severity (P0–P3). P0 incidents involving user data go through our incident-response runbook with a designated incident commander.

Users materially impacted by a confirmed security incident are notified without undue delay via email at the address on file, alongside a public post-mortem where appropriate.