Skip to content
Back to EverikoTrust

Security at Everiko

Everiko handles faces, voices and conversations, so security is designed in, not added on. This page describes what we do today, and is honest about what we have not done yet.

Effective 
Last updated 

At a glance

  • Every connection is encrypted with TLS 1.2 or newer, and HTTP is redirected to HTTPS.
  • During private testing, nothing in the application is reachable without an invited account.
  • Passwords are stored only as salted, memory-hard or iterated one-way hashes.
  • We collect face and voice data only with explicit consent, and you can delete it at any time.
  • We follow GDPR and India’s DPDP Act. We have not yet had a SOC 2 audit.

Encryption in transit

All traffic to everiko.com and app.everiko.com uses HTTPS with TLS 1.2 or 1.3 and certificates that renew automatically, with HTTP Strict Transport Security so browsers refuse unencrypted connections. Traffic between our servers travels over encrypted tunnels. Live calls use encrypted WebRTC media (DTLS-SRTP).

Access control

  • Invitation only. While Everiko is in testing, every page, API call and live connection requires an access account that our team created; requests are checked by both the web server and the application.
  • Least privilege. Databases and internal services are not exposed to the internet; only the public web entry point is.
  • Administration. The administration console is open only to designated administrators, and their actions are logged.
  • Files such as photos and voice are served through signed links that expire, never from a public folder.

Accounts and sessions

  • Sign-in attempts are rate-limited; an account locks for 15 minutes after five wrong passwords, and the response never reveals whether an account exists.
  • Sessions are signed, stored in secure cookies that scripts cannot read, and expire.
  • Sign-in forms only accept submissions from our own pages, which prevents cross-site sign-in attacks.
  • Sign-in with Google, GitHub or Microsoft uses state and PKCE protection, and only provider-verified email addresses can link to an existing account.
  • Every sign-in attempt is recorded, without the password.

Data handling

  • Face and voice data are processed only with explicit consent, only to provide your twins, and never to train models for others.
  • You can download your data and request deletion of your account from within the application.
  • Secrets and credentials are kept out of source code and out of software images.
  • Retention periods are set out in the App Privacy Notice.

Infrastructure

The application and its database run on servers we operate in India, behind a protected network edge and a front door that only accepts secure connections. Service providers who process data for us are listed in the App Privacy Notice, each under contract.

Logging and monitoring

We log requests, sign-in attempts and administrative actions, monitor service health, and keep request logs for a limited time. Logs never contain passwords.

Incidents

If an incident affects personal data, we contain it, investigate, and notify affected people and the authorities as the law requires, including the Data Protection Board of India and, where the GDPR applies, the supervisory authority within 72 hours.

Compliance

  • GDPR and India’s DPDP Act, 2023: we follow both; our privacy notices, consents and data-rights tools are built around them.
  • SOC 2: we are organising our controls around the SOC 2 Trust Services Criteria. We have not yet had an independent SOC 2 audit and do not claim SOC 2 compliance or certification.
  • ISO 27001, HIPAA: not certified. Everiko is not a medical device.

Reporting a vulnerability

If you believe you have found a security problem, please write to [email protected] with the details and how to reproduce it. Please do not access other people’s data, degrade the service, or make the problem public before we have fixed it. We will acknowledge your report and keep you informed.