Skip to content

SECURITY

Security at Proof of Actor

Trust infrastructure has to be trustworthy itself. This page describes how we approach security while Proof of Actor is in development, what we publish, what we keep private, and how to report a vulnerability.

Proof of Actor is in development and does not operate a production verification service. We do not claim certifications or compliance attestations we do not hold. When that changes, this page will say so, with evidence.

Principles

How security shapes the design

Minimal data by design

The safest data is data never collected. Attestations are designed to carry claims rather than raw signals, and to request only what a policy needs.

Evidence over verdicts

Outputs are confidence and evidence signals. We do not claim any system is impossible to spoof, and we design for adversaries who adapt.

Revocable authority

Agent mandates are designed to expire and to be withdrawable by their principal, with relying services able to see that they are no longer valid.

Auditability

Consequential attestations are designed to be tamper-evident and retrievable, so decisions made on them can be reviewed.

Disclosure policy

What we explain, and what we deliberately do not

We publicly explain what Proof of Actor establishes. We are selective about how, because published detection methods become evasion guides.

We publish

  • The problem, the thesis and the Actor model
  • What each primitive is designed to establish
  • Proposed interfaces, clearly labelled as previews
  • Architecture principles and privacy commitments

We keep private

  • Scoring algorithms and signal weightings
  • Detection techniques and behavioural fingerprints
  • Model architecture and anti-evasion systems
  • Challenge-selection algorithms and fraud thresholds
  • Spoof detection methods and bypass research

Responsible disclosure

Report a vulnerability

If you believe you have found a security issue in this website or any Proof of Actor system, please tell us privately so we can fix it before it is disclosed.

  • Include enough detail to reproduce the issue, and the affected URL or component.
  • Do not access, modify or delete data that is not yours, and do not degrade the service for others.
  • Give us reasonable time to respond and remediate before public disclosure.

We will acknowledge good-faith reports, keep you informed, and credit you if you wish.

[email protected]