A verified record has to be trustworthy
Credda exists to make reliability portable and verifiable. That only works if the record itself is tamper-evident, access is tightly scoped, and privacy stays in your hands. Here is how we approach it.
Core principles
Tamper-evident by design
Every commitment writes to a hash-chained audit log. Each entry references the hash of the one before it, so history cannot be silently rewritten.
Both-party confirmation
A reliability signal only counts when both sides confirm the outcome. Scores are built from verified reality, not one-sided claims.
Least-privilege access
API keys are scoped to a single platform and can be revoked instantly. Role-based access controls gate every privileged operation.
Encrypted in transit
All traffic to Credda services is served over TLS. Sensitive credentials from connected platforms are never exposed to third parties.
Disclosure you control
You decide how much a share link reveals (full breakdown, score band only, or minimal) and you can rotate or revoke it at any time, which immediately invalidates every copy. You can export your whole account, or delete it.
Verifiable identity
Platform connections are established through OAuth with the source of record. A verified profile is anchored to real, provable accounts.
Operational practices
| Authentication | JWT-based sessions with optional TOTP two-factor, plus OAuth platform linking. API access uses scoped bearer keys: crd_live_ against real data, crd_test_ against an isolated sandbox. Both are stored only as hashes and revocable at any time. |
|---|---|
| Audit logging | Commitment and invoice lifecycle events are recorded in a hash-chained log, so each entry folds in the previous hash. Privileged staff and platform actions are recorded in a separate append-only log with full actor attribution (who, what, when, from where); that one is not hash-chained. |
| Input validation | Every write path is schema-validated and sanitized before it reaches the database. |
| Rate limiting | Per-key request limits protect the API from abuse and enforce fair use across every integration. |
| Data minimization | We store the signals needed to compute trust, and no more. Connected-platform tokens stay scoped and revocable. |
| Separation of concerns | Scoring, verification and identity run as independent modules, each with its own access boundary. |
Responsible disclosure
Found a vulnerability? We want to hear from you before anyone else does. Email a detailed report to security@credda.io (subject "Security disclosure", which reaches the founder directly) and give us a reasonable window to remediate before public disclosure. We won't pursue action against good-faith research that respects user privacy and avoids service disruption.
- No data destruction
- No privacy violations
- No service disruption
- Coordinated timeline
Note: Credda is an early-stage platform under active development. This page describes our security posture and intent; formal compliance certifications are part of our planned work, not a current claim.