Privacy and Security
Privacy and security guarantees for Zipwire Attest, including data handling, user control, and security measures.
Overview
Zipwire Attest is built with privacy and security as core principles. This page explains how we protect your data, maintain your privacy, and ensure the security of your digital identity.
Privacy-First Design
Your Data, Your Control
Zipwire Attest follows a self-sovereign identity model where you maintain complete control over your personal information:
Centralized but Encrypted: Your personal documents are stored in centralized, double-encrypted storage
Country Selection: You choose which country to store your data in
Selective Disclosure: You choose exactly what information to reveal and to whom
Self-Sovereign: You own and control your proofs and attestations
What We Store vs. What We Don't
What We Store (Securely)
Double-encrypted PII in centralized storage (we cannot read the encrypted data)
Cryptographic hashes on the blockchain (Merkle roots)
Attestation records on the Base blockchain
Verification metadata (timestamps, attestation IDs)
What We Don't Store
Unencrypted personal documents in our systems
Your private keys or wallet credentials
Your browsing history or usage patterns
Personal information in plain text
Security Measures
Document Security
Double Encryption
Your documents are protected by multiple layers of encryption:
Application-level encryption by Zipwire
Cloud provider encryption by our storage partner
Transport encryption (TLS) for all data transmission
Localized Storage
Regional compliance: Data stored in your chosen region
Sovereign data: Your customers choose where to store documents
No cross-border transfer: Data stays within your selected jurisdiction
Blockchain Security
On-Chain Protection
Cryptographic hashes only: Only Merkle root hashes are stored on-chain
No personal data: Your actual documents never appear on the blockchain
Immutable records: Attestations cannot be altered once recorded
Verifiable integrity: Cryptographic proofs ensure data hasn't been tampered with
Attestation Security
Revocable attestations: Zipwire can revoke attestations if needed
Timestamp validation: Attestations include verification timestamps
Attester verification: All attestations come from Zipwire's verified address
Wallet Security
Connection Requirements
EOA wallets only: Externally Owned Account wallets supported
Browser extensions: MetaMask and similar wallet extensions
No smart contracts: Smart contract wallets not currently supported
Connection timing: Wallet must be connected before ID verification
Private Key Protection
Never stored: We never see or store your private keys
SIWE only: Only Sign-in with Ethereum (SIWE) is used, no transactions to sign
No access: We cannot access your wallet or funds
Data Handling
Document Processing
Verification Process
Temporary processing: Documents processed temporarily for verification
Immediate encryption: Data encrypted as soon as it's received
Secure deletion: Temporary processing data deleted after verification
No retention: We don't retain unencrypted document data
Merkle Tree Creation
Local processing: Merkle trees created in secure, isolated environments
Salt generation: Random salts prevent preimage attacks
Hash computation: Cryptographic hashes computed securely
No data leakage: Original data never leaves the secure environment
Data Retention
Attestation Data
Permanent on-chain: Attestation records are permanent on the blockchain
User-controlled: Users can delete their local document data
Verifiable forever: Attestations remain verifiable even after local data deletion
Document Storage
User-controlled retention: You control how long documents are stored
Download and delete: You can download your data and delete it at any time
GDPR compliance: Data will be deleted if you abandon your account
No backup copies: We don't create backup copies of your documents
User Control and Rights
Selective Disclosure
Complete Control
Choose what to reveal: Select exactly which fields to share
Context-specific: Different proofs for different use cases
No over-sharing: Never reveal more than necessary
Revocable sharing: Stop sharing proofs at any time
Proof Management
Download proofs: Save ProofPacks locally for offline use
Edit proofs: Advanced users can create custom redacted proofs
Share selectively: Choose who receives your proofs
Track usage: Monitor where your proofs are used
Data Deletion
Right to Delete
Immediate deletion: Delete your documents at any time
Complete removal: All local data removed from our systems
Attestation preservation: Blockchain attestations remain for verification
No recovery: Deleted data cannot be recovered
Technical Deletion
Secure deletion: Data overwritten multiple times before deletion
Verification: Confirmation that data has been completely removed
Audit trail: Record of deletion for compliance purposes
Compliance and Standards
Regulatory Compliance
GDPR Compliance
Right to be forgotten: Complete data deletion capability
Data portability: Export your data in standard formats
Consent management: Clear consent for data processing
Privacy by design: Privacy built into every feature
Regional Compliance
Local data storage: Choose your data storage region
Regional regulations: Comply with local privacy laws
Cross-border restrictions: Respect data sovereignty requirements
Security Standards
Industry Standards
SOC 2 compliance: Security and availability controls
ISO 27001: Information security management
Encryption standards: AES-256 encryption for data at rest
Transport security: TLS 1.3 for data in transit
Blockchain Standards
EAS compliance: Ethereum Attestation Service standards
Base network: Secure Layer 2 blockchain
Cryptographic standards: Industry-standard hash functions
Signature verification: ECDSA and other standard algorithms
Threat Protection
Attack Prevention
Preimage Attack Protection
Random salts: Each data field has unique random salt
Hash protection: Salts prevent reverse-engineering of data
Cryptographic strength: Industry-standard hash functions
Tampering Prevention
Merkle tree integrity: Cryptographic proofs prevent data tampering
Blockchain immutability: On-chain records cannot be altered
Signature verification: JWS envelopes prevent document tampering
Transparency
Open Standards
ProofPack specification: Open standard for data exchange
EAS integration: Open blockchain attestation service
Verifiable code: Open source verification libraries
Public attestations: All attestations visible on blockchain
Best Practices for Users
Security Recommendations
Secure wallet: Use a hardware wallet for maximum security
Regular updates: Keep your wallet software updated
Backup proofs: Store ProofPacks securely for offline use
Monitor attestations: Regularly check your attestation status
Privacy Recommendations
Minimal disclosure: Only share what's absolutely necessary
Context awareness: Use different proofs for different contexts
Regular cleanup: Delete old documents and proofs regularly
Stay informed: Keep up with privacy and security updates
Related Resources
Last updated