How Nyvarra protects certificates and accounts

Signing and keys

Each certificate is signed when it's issued, using Ed25519, a widely used digital signature standard. Signing keys are kept secret and never leave Nyvarra's systems.

• The public half of every key is published, with its fingerprint, on each issuer's public profile, so anyone can see which keys an issuer has signed with.
• Checks use the key in Nyvarra's registry, never a key carried inside the certificate.
• When a key is replaced, certificates it signed stay valid. If a key is withdrawn, every certificate it signed stops showing as genuine at once.
• Issuers' public keys are also published as did:web documents, so other software can check Nyvarra certificates without Nyvarra's tools.

Fingerprints and files

Every certificate's record and its PDF each have a SHA-256 fingerprint, stored when it's issued.

• Before a PDF is sent to anyone, it's checked against its fingerprint. If the bytes don't match, Nyvarra refuses to send it.
• A withdrawn or replaced certificate's files stop being served at once, while its status stays visible.
• Anyone can check a PDF by its fingerprint without uploading it: the browser computes the fingerprint and sends only that.

Accounts and access

• Passwords are never stored, only secure hashes of them, and new accounts must confirm their email address.
• Sign-up and sign-in are protected against automated abuse.
• Anyone can turn on two-step sign-in with an authenticator app, with backup codes. Nyvarra's own staff must use it.
• People are emailed when their account security changes, such as two-step sign-in being turned off.
• Within an organization, only owners and admins can manage the team, and each organization's data is kept separate from every other's.
• Anyone can export their data or delete their account from their settings.

Audit and records

• Important actions, such as approving an organization or changing its name, are written to an audit log that can't be edited or deleted.
• Payment records are only ever added to, never rewritten.
• Certificate checks are logged to detect abuse, as described in the privacy notice.

Backups and data

• All traffic to Nyvarra is encrypted with HTTPS, and stored data is encrypted at rest.
• Changes are backed up continuously and encrypted. Copies are kept in more than one place, including storage that can't be changed or deleted for a fixed period, even by Nyvarra.
• Restoring from backup is tested automatically, and Nyvarra is alerted if a backup fails.
• The providers Nyvarra uses, and what personal data is kept and for how long, are listed in the privacy notice.

Public checks

• Public pages and the API show only what a checker needs. Recipients' email addresses, internal IDs and private settings are never included.
• Public endpoints are rate limited to prevent abuse.
• A check that can't be completed answers “couldn't check”, never “genuine”.

Monitoring and incidents

Nyvarra's main services are checked around the clock, and the results are public on the status page with 90 days of history. Incidents are posted there with updates until they're resolved.

Security reviews

If your organization needs certifications, a security questionnaire answered, or other evidence for a review, write to info@nyvarra.app.

Reporting a vulnerability

If you've found a security problem, email info@nyvarra.app with the details and how to reproduce it. Please give us a chance to fix it before telling anyone else, and don't access other people's data while testing. Every report is read by a person.