Encryption
All traffic to the dashboard and API runs over TLS. Verification records, result payloads and audit logs are encrypted at rest, and secrets and API keys are stored separately from application data.
Access control
Each organisation sees only its own checks. Inside an organisation, roles determine who can run a check, who can view a stored result and who can manage users and keys.
Internal access to production data is limited to the engineers who need it, is granted for a specific purpose and is logged.
Audit trail
Every check is stored with a reference, the requesting user, the attributes submitted, the source consulted, the verdict and the timestamp. The record cannot be edited after the fact, which is what makes it usable as evidence.
API key handling
Sandbox and production keys are separate. Keys can be rotated without downtime, are shown once at creation and can be revoked immediately if exposure is suspected.
Resilience
Data is backed up on a regular schedule with restores tested periodically. Where an upstream source is unavailable, requests fail closed with an inconclusive result rather than returning an unverified answer as verified.
Reporting a vulnerability
If you believe you have found a security issue, write to sales@ugmail.co with the details and steps to reproduce. We will confirm receipt, investigate and keep you informed. Please do not test against real customer data.