Security

Security you can verify

We use accurate language: no system can make identity theft, breaches, or tampering impossible. BlockID is designed to reduce risk and make tampering easy to detect.

No sensitive data on a public chain

BlockID uses a private ledger. No personal or credential data is published to any public blockchain.

Private tamper-evident ledger

An append-only, hash-chained ledger inside your own database makes unauthorized changes detectable.

Hash chaining

Each block binds the previous hash, type, payload hash, timestamp, and author, so the chain can be re-verified end to end.

Digital signatures

Credentials are signed (RSA-SHA256) and verified against the issuer’s public key.

Credential revocation

Revoked credentials fail verification immediately and the event is recorded on the ledger.

Secure sessions

HttpOnly, SameSite, and Secure cookies; session regeneration; idle and absolute timeouts.

Role-based access

Five roles with a centralized permission model enforce least privilege.

Organization isolation

Tenant scoping prevents cross-organization data access (IDOR-resistant lookups).

Prepared statements

All database access uses PDO prepared statements to prevent SQL injection.

CSRF protection

State-changing requests require per-session CSRF tokens.

Audit trails

Security and business events are logged for monitoring and review.

Rate limiting

Public verification and form endpoints are rate-limited to reduce abuse.

Production hardening checklist

  • Enforce HTTPS and enable HSTS; set secure cookies
  • Move signing keys to a KMS/HSM; never store private keys in plaintext
  • Deny web access to config, core, and storage directories
  • Centralize logging and monitor failed-login and verification spikes
  • Test backups and restores regularly, including key material
  • Complete independent security review and penetration testing

No system can make identity theft, breaches, or tampering impossible. BlockID is designed to reduce identity-theft risk, reduce breach impact, minimize unnecessary storage of sensitive identity data, and make tampering easier to detect.