Resources
Security & Privacy
Prism's security model follows one rule: prove what is necessary without revealing what is unnecessary. Everything below is a consequence of that rule, across Prism, Organic DÃO and ADI.
The rule
If a venue needs to know somebody is over 18, Prism proves Over 18 — not a date of birth. If a brand needs to know it is dealing with a verified human, Prism proves Verified Person — not a passport.
Controls
Encryption and key handling
- Encryption in transit and at rest across every store.
- Per-user encryption boundaries, so one member's sensitive fields are not decryptable alongside another's.
- Sensitive identity and biometric references held separately from ordinary profile data.
- Managed secrets, scheduled key rotation and no long-lived credentials in application code.
Sessions and access
- Short-lived access tokens with rotating refresh tokens.
- Purpose-scoped, time-bounded grants per data category — access never renews itself.
- Re-authentication before sensitive surfaces and before any new disclosure.
- Rate limiting and attempt limits on verification, sharing and invitation flows.
Integrity of the bridge
- Every request between Prism and Organic DÃO is HMAC-signed over the raw body.
- Timestamped with a replay window and rejected outside it.
- Idempotency keys make re-delivery a no-op on the receiving side.
- Delivery, acknowledgement and anchoring state are recorded in a durable outbox.
Audit
- Every grant, refusal, expiry and revocation writes an immutable consent event.
- Every administrative and provider action is attributable to an actor and timestamp.
- Ordinary logs never contain passport images, licences, biometric templates, tokens, contract contents or private profile fields.
Screen privacy
A second camera can always photograph a phone display, so Prism makes no claim that photography is impossible. Instead, credentials are architected so that a photograph is worthless: it has already expired, or it fails the cryptographic challenge.
- Minimise what is displayed — show a claim, not the evidence behind it.
- Rotating, challenge-bound credentials so a captured image cannot be replayed.
- Moving watermarks carrying the holder's own Prism identifier.
- Sensitive views expire, and obscure when the app loses focus or enters the app switcher.
- Block screenshots and screen recording where the operating system permits.
- Keep sensitive information out of notifications and the clipboard.
The Prism confirmation gesture is a branded press-and-hold interaction, reinforced by device-level biometrics where available. A standard touchscreen does not read fingerprints, and Prism never implies otherwise.
What never reaches a chain
Anchoring exists to make a fact independently verifiable, not to publish it. Organic DÃO anchors hashes, proofs and Merkle roots to ADI. The following never leave Prism's encrypted boundaries.
NamesAddressesPassport and licence numbersDates of birthPhone numbersEmail addressesBiometric imagery or templatesPurchase contentsPrivate messages
