Security

Data minimization

• SHA-256 fingerprints are computed in the browser for issue and verify flows.
• The registry stores the fingerprint, issuer-supplied metadata, lifecycle status, and timestamps—not the document file.
• The optional malware action streams bytes to a separate private ClamAV container without a shared file volume. Only fingerprint and verdict metadata are retained.
• Issuer-pinned QR links bind a fingerprint check to the expected issuer name.
• Revocation is append-preserving: the record remains available with revoked status, time, and reason.

Application controls

• Public verification is separated from authenticated issue, dashboard, billing, and revoke operations.
• Deployments can use a pre-shared API key, Cognito JWTs, SAML, or OIDC sessions.
• Registration and verification have independent per-client rate limits and request-size limits.
• Malware scans are size- and time-bounded. A disabled, warming, timed-out, or unreachable scanner returns unavailable and is never represented as clean.
• Stripe webhooks require a valid timestamped signature and fail closed when webhook verification is not configured.
• Security headers restrict framing, content types, browser capabilities, referrers, and script/network sources.
• Automated tests cover authorization, issuer isolation, duplicate races, revocation, CORS, input abuse, webhook forgery, and browser accessibility.

Infrastructure controls

The supported AWS Fargate deployment terminates TLS at an Application Load Balancer, restricts tasks to load-balancer traffic, uses IAM task roles instead of embedded AWS keys, stores secrets in SSM Parameter Store, encrypts DynamoDB with KMS, enables point-in-time recovery and deletion protection, and publishes structured logs. When malware scanning is enabled, a patch-pinned ClamAV image is pulled from private ECR and clamd is reachable only over the task’s loopback network; its unauthenticated TCP protocol is not publicly exposed. Production sizing and availability settings are environment-specific.

Security boundary

RohaVerify confirms a byte-for-byte fingerprint match and the registry state supplied by an issuer. An optional ClamAV result reports whether its current signatures detected known malware; “no known malware detected” is not proof that a file is safe. RohaVerify does not inspect a document’s meaning, validate every factual statement in it, prove the identity of the person presenting it, or replace legal, regulatory, or professional review.

Report a vulnerability

Email support@rohait.com with the affected endpoint, reproduction steps, impact, and a safe way to contact you. Do not access other users’ data, degrade the service, or publish an unpatched issue. We will acknowledge reports and coordinate remediation.