Legal · Security Practices
Security Practices
Effective September 15, 2024 · Last updated February 2025
Disclaimer for the download/accept screen of the App: By installing or using ONEPROOF applications and SDKs, you are agreeing to the terms of our current Privacy Policy, Terms of Use, Cookie Policy, and Acceptable Use Policy. We encourage you to read, revisit, and use these documents to help you make informed decisions.
ONEPROOF INC Security Practices for ONEPROOF Digital Identity SDKs, Libraries, Container Images, and Hardware Products
This Security Information document applies to ONEPROOF INC (“ONEPROOF”) digital identity SDKs, client libraries, container images, and Edge hardware products (collectively, the “Software”). ONEPROOF does not operate a hosted cloud service; all Software is deployed and operated by the customer in their own environment. This document describes ONEPROOF’s security practices as a software and hardware vendor, and what enterprise customers receive as part of every engagement.
Security is built into our platform at two levels: at the credential-protocol level through implementations of applicable ISO, OpenID, W3C, ICAO, and regional profiles, and at the software delivery level through CVE monitoring, secure development practices, and supply chain integrity controls.
01Security Framework and Governance
ONEPROOF’s security program is aligned with industry-recognized frameworks:
- •NIST Cybersecurity Framework: Our development and operational practices are aligned with the NIST CSF Identify, Protect, Detect, Respond, and Recover functions
- •OWASP Security Guidelines: All application and SDK development follows OWASP recommendations for secure software design
- •Secure Development Lifecycle (SDLC): Security is integrated throughout the development process from design through release, including threat modeling and security review at each stage
02SDK and Package Security
Every ONEPROOF enterprise engagement includes ongoing security maintenance of the Software artifacts you receive:
- •CVE Monitoring: All published SDKs, libraries, and container images are continuously monitored against known CVE databases. When a relevant vulnerability is identified, a patched release is issued and enterprise customers are notified
- •Dependency Scanning: All third party dependencies across every SDK and library are scanned for known vulnerabilities at build time and on an ongoing basis
- •Container Image Scanning: All published container images are scanned for CVEs prior to release. Patched image versions are distributed to customers as part of the enterprise service
- •Security Patch Distribution: Security fixes are distributed as SDK and library updates. Enterprise customers receive direct notification of security releases with remediation guidance
- •Software Bill of Materials (SBOM): SBOM is available to enterprise customers on request, providing full visibility into the dependency tree of every delivered artifact
03Supply Chain Security
ONEPROOF maintains integrity controls across the software supply chain:
- •Artifact Signing: Published SDKs, libraries, and container images are signed. Customers can verify artifact integrity before deployment
- •Reproducible Builds: Infrastructure as Code and automated build pipelines support consistent, reviewable artifact production with no manual intervention in the release chain
- •Dependency Pinning: All dependencies are pinned to verified versions. Transitive dependency updates go through the same CVE scanning and review process as direct dependencies
- •Third Party Vendor Assessment: All third party tools and services used in development and build pipelines are assessed for security posture before adoption
04Application Security
ONEPROOF implements comprehensive application security measures in all Software:
- •Static Analysis (SAST): Static Application Security Testing is integrated into the CI pipeline for every SDK and library release
- •Dynamic Analysis (DAST): Dynamic testing is performed on server side components prior to release
- •Mobile App Security: Certificate pinning, anti-tampering measures, and secure storage implementation in all mobile SDK components
- •Cryptographic Implementation: Credential processing uses the algorithms, encodings, and verification rules defined by each applicable credential standard or profile
05Cryptographic Security
Security is applied according to the assurance model defined for each supported credential format:
- •Format-Specific Signatures: Compatible mdoc issuance uses COSE, while other supported formats use their applicable signature and assurance models
- •Customer Deployment Boundary: Customer-deployed verification does not send raw credential data to ONEPROOF
- •Selective Disclosure: Compatible credential and presentation protocols allow verifiers to request the fields needed for a transaction and allow the holder to consent to presentation
06Identity and Access Management
ONEPROOF enforces strict access controls across internal systems:
- •Multi-Factor Authentication (MFA): Required for all employee accounts accessing internal systems, build pipelines, and code repositories
- •Role-Based Access Control (RBAC): Granular permissions based on job function and the principle of least privilege
- •Privileged Access Management: Just-in-time access and automated privilege revocation for sensitive systems
- •Access Reviews: Regular access certification and automated deprovisioning for departing employees
07Vulnerability Management
Proactive identification and remediation of security vulnerabilities across all published Software:
- •Continuous CVE Scanning: All SDKs, libraries, container images, and dependencies are scanned against CVE databases continuously, not just at release time
- •Patch Prioritization: Critical and high severity CVEs are remediated and released on an emergency basis. Medium and low severity follow the standard release cycle
- •Responsible Disclosure: Security researchers and customers can report vulnerabilities to security@oneproof.com. We acknowledge reports within 2 business days and communicate remediation timelines
- •Customer Notification: Enterprise customers are notified directly when a security patch affects their licensed Software, with clear remediation steps and updated artifact versions
08Incident Response
ONEPROOF maintains documented incident response procedures:
- •Incident Response Plan: Documented procedures for incident classification, escalation, and resolution covering Software vulnerabilities and supply chain events
- •Dedicated Response Team: Named individuals with defined roles and responsibilities for security incident handling
- •Customer Communication: Enterprise customers are notified of security incidents that affect their licensed Software within a defined SLA. Notification includes impact assessment and remediation guidance
- •Post-Incident Review: All security incidents result in a documented root cause analysis and process improvement actions
09Employee Security
Human factors are critical to our security posture:
- •Background Checks: Comprehensive background screening for all employees with access to production systems, code repositories, and customer data
- •Security Training: Mandatory security awareness training and role-specific security education for all engineering and operations staff
- •Confidentiality Agreements: All employees sign NDAs and security acknowledgment agreements covering customer data and source code
10Privacy by Design
Privacy behavior combines protocol capabilities with controls inside the customer’s deployment:
- •Customer-Controlled Retention: Customers configure retention and data-handling policies within their own deployment boundary
- •Selective Disclosure: Supported mdoc and compatible presentation flows allow requested fields to be limited according to the transaction and holder interaction
- •No ONEPROOF Data Collection During Verification: ONEPROOF does not receive, store, or have access to credential data exchanged between holders and verifiers. The Software operates entirely within the customer’s deployment boundary
- •Customer Deployment Controls Privacy: Because ONEPROOF Software is deployed and operated by the customer, the customer controls retention and privacy policies within its environment. ONEPROOF provides technical guidance for GDPR and CCPA aligned deployments on request
How to Contact Us
Security-related questions, vulnerability reports, or incident notifications should be directed to:
- Security Team: security@oneproof.com
- Privacy Inquiries: privacy@oneproof.com
Updates to This Document
ONEPROOF regularly updates our security practices and this document as our Software evolves. Enterprise customers are notified of material changes to security practices that affect their licensed Software.