Security checklist

Protocol controls

• Use Authorization Code with PKCE when the executable contract is published.
• Validate issuer, audience, signature, expiration, state, nonce, and exact redirect binding.
• Keep private keys and server credentials out of browser storage and public builds.
• Separate test and live keys, redirects, subjects, and operational data.
• Support rotation, revocation, replay prevention, and auditable configuration changes.

Data minimization

• Request only claims required for the reviewed product decision.
• Do not request or store government-ID images, selfies, biometrics, or expanded verification reports.
• Do not use a Persona claim to infer an unrelated sensitive attribute.
• Do not attempt to correlate pairwise subjects across applications.
• Delete or revoke application data when its stated purpose ends.

Architecture boundary

Ledgr authenticates people. SupahID hosts the human experience. Relay serves the future public application path, and Atlas holds private developer authority. No browser client receives an internal service credential.