You do not have to trust us to check our math.
Most security pages ask you to believe a list of controls. This one says what we hold, what we never hold, and what is not done yet. Manav is designed so that an outage on our side does not stop verification, and a breach on our side cannot forge a receipt.
Last updated 24 September 2026
The short version
- We never hold the secret. Signing happens in the authenticator on the person's device. The private key never leaves it, and there is no biometric vault to breach.
- Verification does not call us. A receipt is checked against a published key set and a signed revocation list. Both can be cached, and an offline verifier gets the same answer we would.
- We are not yet SOC 2 certified. Compliance status says exactly where we are.
Posture at a glance
The controls a security questionnaire asks about, on one screen. The whitepaper and the conformance suite, with every command and its expected output, go to evaluating customers: talk to an engineer.
| Control | Status | Detail |
|---|---|---|
| Key custody | Users' keys never reach us | Signing happens in the person's authenticator. Our issuer keys are kept out of the web root with owner-only permissions; signing refuses to run if a key is missing or exposed. |
| Signatures | Hybrid, fail-closed | Ed25519 + ML-DSA-87 (FIPS 204). A verifier checks both halves and rejects if either is missing, so a downgrade is a reject. |
| What gets signed | The text the person saw | The action is canonicalised with RFC 8785 (JCS), and every machine-readable field must also appear in the human-readable text. |
| Rotation & revocation | Scripted | Both keys rotate together under one key ID; retired keys keep verifying until they expire. The revocation list is re-signed at least every 5 minutes. |
| Transparency | RFC 9162 Merkle log | Append-only, with a signed tree head; inclusion proofs can be exported to your auditor. |
| Verification uptime | Does not depend on us | Verifiers cache the public keys and revocation list; a static key set is served even if the issuer is down. |
| Transport | TLS 1.2/1.3, HSTS | HTTP redirects to HTTPS; CSP, X-Frame-Options, Referrer-Policy and Permissions-Policy on every response. |
| Monitoring | Checks every 5 minutes | Failures page a person and update the status page. |
What we can and cannot see
| We hold | We never hold |
|---|---|
| The receipt: what was signed, by which credential, when | Your private key — it stays in the authenticator |
| The issuer's own signing keys, outside the web root | Biometric templates. There is no biometric vault |
| Hashed IP for abuse control on the waitlist | Behavioural telemetry or cross-site tracking |
| Account email and the profile fields you authorise at sign-in | The contents of systems you gate with Manav |
You cannot leak what you never hold. That is a design property here, not a policy promise.
Compliance status
| Item | Status |
|---|---|
| SOC 2 Type I | Not started |
| SOC 2 Type II | Not started |
| ISO 27001 | Not started |
| Independent penetration test | Not yet commissioned. When it is, we will publish the attestation letter: firm, scope, dates and severity counts. |
| Independent cryptographic review | Not yet commissioned |
| CSA STAR Level 1 self-assessment | Not started |
| Subprocessors | Published |
| Vulnerability disclosure policy | Published |
We would rather say this plainly than imply a certification we do not hold. Until an audit is done, we hand the conformance suite to every security reviewer who asks.
Reporting a vulnerability
Send it to [email protected]. Our policy, response targets and safe-harbour language are on the disclosure page, and the machine-readable version is at /.well-known/security.txt.
Request the evidence pack
Everything a security review needs, in one reply: the conformance suite with expected outputs, the completed questionnaire, the DPA and subprocessor list, and an architecture walkthrough with a named engineer.
Send this to your security reviewer
Everything above is either in place, with how it works, or stated as not done yet.