Security and data | Authenica

What the screening API does

The names you search are not stored anywhere, neither in the call log nor elsewhere. Every call receives an identifier (requestId) that you keep to prove that screening took place.
Identity document images are not kept. The service reads them, returns the result and discards them.
Deny by default. An outage always returns an error (503), never an empty response that would let an operation through.
List version. Every result states the list and the list batch it comes from.

Access and keys

HTTPS-only access; an HTTP call is redirected.
API keys are issued only once and are not stored in clear text. A lost key is not resent: it is replaced.
Immediate revocation on request; a per-minute call quota agreed for each access; keys may carry an expiry date.
Without a valid key, the API returns 401 with the code API_KEY_REFUSED and a requestId, without echoing anything from the request. Knowing the address grants no access.

Platform audit trail

The audit trail of the platform and its Suites follows these rules.

Events are recorded append-only: the application provides for neither their modification nor their deletion.
Each event is linked to the previous one by a SHA-256 fingerprint: modifying a past event, or deleting an event in the middle of the chain, becomes detectable.
Viewing sensitive data is itself recorded.
Investigations are segregated and protected row by row.

What this chaining protects, and what it does not replace. It makes it possible to check, after the fact, that the history has not been rewritten. It does not replace access control, backups or an independent audit, and it is not a certification.

Our approach to security

Authenica intends to build security into the design, development and operation of its services. The applicable measures depend on the risks, the architecture deployed, the data processed and contractual commitments.

They may cover access management, protection of exchanges, logging, vulnerability management, backups, service continuity and incident handling.

Report an incident

Any suspected unauthorised access, data disclosure or vulnerability relating to Authenica services can be reported to it@authenica.tech.

Use the subject "Security report — Authenica", with a description of the problem, the approximate date and the service concerned. Avoid sending unnecessary personal data, passwords or authentication secrets.

Reports are reviewed according to applicable internal procedures. Notification obligations are assessed in light of the regulations and the respective responsibilities of the parties.

Data and AI governance

Authenica aims for responsible management of data and automated processing. This governance covers roles and responsibilities, data access, purposes and retention periods, traceability, control of automated results, human review where necessary, and the handling of incidents and requests from data subjects.

Compliance commitments

Using the platform does not, in itself, guarantee regulatory compliance for the client. Applicable obligations depend in particular on its sector, its status and the countries in which it operates.

Authenica does not currently claim any certification, approval, regulatory authorisation, independent audit or partnership. Any such reference on this site will correspond to a real and verifiable situation.

Last updated: 18 October 2026