Security

AIN Verify is trust infrastructure, so we document precisely how it protects identities, authority and decisions — and where its guarantees currently end.

Identity and keys

• Each agent is bound to an Ed25519 public key. When AIN generates the key pair, the private key is shown once and never stored.
• Agent proofs bind a signature to a specific action, timestamp (±5 minutes) and single-use nonce, preventing replay and tampering.
• Key rotation takes effect immediately; old keys stop verifying.

Authority

• Issuing a mandate, creating API keys, rotating keys and changing agent status require re-entering your password (step-up authentication, valid 10 minutes).
• Revoking a mandate never requires step-up: removing authority should always be fast.
• Revocation and suspension take effect on the very next verification — there is no cache to expire.
• Cumulative limits are enforced atomically, so concurrent requests cannot overspend a mandate.

Decisions and audit

• Every verification response is signed with AIN's Ed25519 key, published at /.well-known/ain-keys.json.
• All identity, authority, credential and decision events are written to an append-only audit log. Each entry includes the SHA-256 hash of the previous one; the database rejects updates and deletes, and any tampering breaks the chain, which admins can check at any time.

Accounts and application

• Passwords are hashed with scrypt. Sign-in, sign-up and verification are rate-limited.
• Sessions use HttpOnly, SameSite cookies with CSRF tokens; API keys are stored as SHA-256 hashes.
• Strict Content-Security-Policy, no third-party scripts, clickjacking protection and HTTPS-only cookies in production.
• Role-based access: owners, admins and read-only members.

Current limitations

• Organization identity is self-attested. We do not yet perform business verification (KYB).
• Email ownership is not yet verified, and multi-factor authentication is not yet available.
• AIN does not process payments and is not connected to any payment network.

Reporting a vulnerability

Email security@ainverify.com. Please give us reasonable time to fix issues before disclosure.