This page describes how the Service works today. It'll change as the product does, we'd rather update it than let it go stale.
Credentials
Passwords and API key secrets are hashed with Argon2id, a memory-hard hashing algorithm built specifically to resist large-scale cracking attempts, using separate cost settings tuned for each. We never store either in plain text or in a reversible form. An API key's secret is shown to you once, at creation, and from then on we only hold its hash, the same as a password.
Tenant isolation
Every account's data, keys, seals, and activity is scoped to that account at the database query layer, not just hidden in the interface. We run this as an automated check: part of our test suite exists specifically to seal a file under one account and confirm a second account can never see it, and that check runs before any change ships.
Transport and session security
All traffic to the dashboard and API runs over TLS. Dashboard session cookies are set httponly and samesite, and marked secure whenever served over https, so they can't be read by a script on the page or replayed across sites. Every state-changing action in the dashboard is protected against cross-site request forgery with a double-submit cookie check.
Internal access
Our own staff console is deny-by-default. Someone without staff access gets a plain 404, not a 403 that would at least confirm the console exists. Staff access itself can't be granted through any API call, form field, or signup flow, only through a direct, logged command on our own infrastructure.
Where your photos go, and don't go
Forensic analysis runs on our own infrastructure using deterministic signal-processing techniques we built ourselves: metadata extraction, pixel-frequency analysis, and compression-history checks. We don't send submitted photos to a third-party AI vendor to get a verdict. If you enable cryptographic timestamping on a seal, the only thing sent to the external timestamp authority is a hash of the file, never the photo itself.
The seal itself
A .prfd seal is a cryptographic signature (ECDSA over a SHA-256 hash) binding the photo, its metadata, and its verdict into one file. Verifying it doesn't require trusting us in the moment, anyone can check a seal against our public key and get a definitive yes or no, independent of whether our servers are even reachable.
Reporting a problem
If you find a security issue, we want to hear about it before anyone else does: hello@prfd.io.