Security architecture
When there is nothing to store, compliance gets smaller. When there is nothing to leak, breach disclosure gets shorter. The security story is two sentences.
No passwords anywhere · GDPR Article 17 in one command · Free plan, no card needed
<5s
Time for Touch ID to signed transaction on-chain
1 cmd
GDPR Article 17 erasure — one command
8
Policy enforcement steps before every signal
0
Passwords anywhere in the flow
"When there is nothing to store, compliance gets smaller. When there is nothing to leak, breach disclosure gets shorter."
The seed exists for milliseconds. The transaction is permanent.
The user taps Touch ID. The Secure Enclave PRF derives a key. AES-256-GCM unwraps the Ed25519 seed. The seed exists in memory for the duration of one sign operation — milliseconds.
Touch ID → SE PRF → AES-256-GCM unwrap → Ed25519 seed (milliseconds)
WebCrypto imports the seed as non-extractable. The transaction is signed. The raw bytes are zeroed immediately. The seed is never logged. Never sent over the network. Never stored on ONE's servers.
crypto.subtle.importKey(extractable: false) · seed.fill(0) · tx lands on-chain
The signed transaction goes to the blockchain. The memory is clear. The only record is on-chain. From Touch ID to confirmation in under 5 seconds.
Sui tx · <5 seconds p50 · on-chain record only
Every quarter, a canary transaction fires on each active deployment. The result either verifies or it doesn't. A failed canary triggers immediate investigation. Verification over presence. Deterministic check, not a compliance ritual.
quarterly canary tx · deterministic check · immediate investigation on fail
Smaller compliance surface. Shorter breach disclosure.
Keys live in the Apple Secure Enclave — a dedicated processor Apple's own engineers cannot read. Touch ID is non-transferable by physics, not by policy. There is no password to phish. No credential to steal from a server. Nothing stored server-side.
State 1: ephemeral (zero friction, spending cap). State 2: saved (Touch ID gated, BIP39 paper break-glass). State 3: linked to Google account. State 4: multi-device via iCloud/Google Password Manager. State 5: recovered from 12-word paper. Security grows as the user commits.
persist.forget(uid) deletes the actor and cascades to memberships, capabilities, paths, and signals. Schema handles referential integrity. Audit signal emitted automatically. Article 17 compliance in one TypeQL statement. No cleanup script.
Each client workspace is a separate TypeDB tenant. A deletion request for one client touches nothing else. Tenant key encryption key (KEK) deletion makes data unreadable instantly — no row-by-row deletion across tables.
The co-sign pattern requires a human Touch ID to complete any transaction above a threshold. The scoped autonomy pattern runs agent transactions through a Move module that enforces daily caps at consensus level. "Cannot" is different from "should not."
ABAC, RBAC, ReBAC, capability, budget, rate limit, nonce deduplication, delivery — in that order. No signal reaches an agent without clearing all eight. No silent failures. Every closed signal closes its loop with mark, warn, or dissolve.
| Feature | ONE | Password-based platforms | Self-hosted infrastructure |
|---|---|---|---|
| Keys in Secure Enclave — never on server | |||
| No passwords anywhere in the flow | |||
| GDPR erasure in one command (Article 17) | |||
| Per-tenant KEK isolation | |||
| 8-step policy enforcement before every signal | |||
| Quarterly canary verification (deterministic) | |||
| Physical infrastructure control (your servers)Honesty: self-hosted infrastructure on your own servers wins on physical control. ONE outsources that to Cloudflare and TypeDB Cloud. |
Verified on-chain
Verification over presence applies on-chain too. The payment coupon verifier is deployed with its full source public on the block explorer. A recent security pass added EIP-712 domain binding — a signed coupon is now bound to one contract on one chain, so it can't be replayed against another contract or a different deployment.
Base Sepolia · chain 84532 · source-verified
Secure Enclave and 8-step enforcement on every plan.
Passkey auth · basic GDPR tools
Full compliance · co-sign pattern
SOC 2 · dedicated infrastructure
No passwords. No seed phrases on our servers. GDPR erasure in one command. 8-step enforcement before every signal.
Free plan, no card needed · Secure Enclave on every plan