Legal

Security overview

Last updated: 2026-07-23

How thibit protects the data entrusted to the Service. Questions or vulnerability reports: security@thibit.id.

Encryption in transit

All public endpoints are served over TLS, with HTTP Strict Transport Security (HSTS) enabled.

Authentication

API keys are project-scoped, rotatable, and stored hashed at rest. The dashboard uses OAuth sign-in (Google or GitHub) with server-side sessions — no passwords are stored.

Webhooks

Webhook deliveries are HMAC-signed so integrators can verify their authenticity and integrity.

Data storage

Verification evidence is stored encrypted at rest on AWS (Amazon S3) with an automatic 60-day lifecycle deletion. Personal data is confined to documented persistence paths, and application logs are kept free of raw document and biometric content.

Infrastructure

Access to production infrastructure follows least privilege. Secrets live in managed secret stores, not in source control.

Monitoring

Production services run with error monitoring and alerting.

Responsible disclosure

Report suspected vulnerabilities to security@thibit.id (see also /.well-known/security.txt). We acknowledge good-faith reports, ask for enough detail to reproduce, and will not pursue researchers acting in good faith.

Last updated: 2026-07-23