Security

Identity authority stays separate from application access.

Supah minimizes what crosses each boundary: Ledgr authenticates people, SupahID hosts the human experience, Relay serves the public API, and Atlas holds private developer authority.

Pairwise subjects

Every application receives a different subject. A developer never receives a global SupahID or internal Ledgr identifier.

Scoped claims

Applications receive only requested, approved, and consented claims. Another application's grants and identity data remain inaccessible.

Verification boundary

Government-ID images, selfies, biometrics, and expanded verification reports do not enter the developer platform.

Short-lived authorization

The design-partner protocol uses expiring tokens, redirect validation, PKCE, rotation, replay prevention, revocation, and auditable configuration changes.

Data minimization

Relay retains edge-only rate, replay, session, and usage state. Atlas stores organizations, applications, environments, public keys, capabilities, and audit history. Neither receives developer private keys or Ledgr identity identifiers.

Report a vulnerability

Send security reports to security@supah.dev. Do not include identity evidence or secrets in the initial message.