1. Security Overview
EVID-DGC is designed with security-first principles to protect digital evidence,
user data, and system integrity. Our architecture combines blockchain immutability
with enterprise-grade off-chain security controls.
2. Encryption Standards
- Data in Transit: TLS 1.2+ encryption for all communications
- Data at Rest: AES-256 encryption for stored files and databases
- Cryptographic Hashing: SHA-256 for evidence integrity verification
- Key Management: Secure key storage and rotation policies
3. Access Control
- Role-based access control (RBAC)
- Multi-factor authentication (MFA) for privileged users
- Wallet-based authentication for blockchain interactions
- Session timeouts and device monitoring
4. Blockchain Security
- Immutable on-chain evidence hash storage
- Public verifiability of transaction records
- Protection against evidence tampering via cryptographic proofs
- Smart contract access restrictions
5. Infrastructure Security
- Secure cloud hosting with hardened servers
- Firewall and intrusion detection/prevention systems (IDS/IPS)
- Regular operating system and dependency patching
- Isolated environments for development, testing, and production
6. Monitoring and Logging
- Continuous system and access monitoring
- Comprehensive audit logs for all critical actions
- Real-time alerts for suspicious activity
- Blockchain transaction monitoring
7. Vulnerability Management
- Regular vulnerability scanning
- Penetration testing and security assessments
- Responsible disclosure process for security issues
- Timely remediation of identified vulnerabilities
8. Incident Response
In the event of a security incident, EVID-DGC follows a formal incident response process:
- Immediate containment and investigation
- Impact assessment and evidence preservation
- Notification to affected stakeholders where required
- Post-incident review and security improvements
9. Data Retention and Backup
- Encrypted backups with secure storage
- Regular backup integrity testing
- Disaster recovery and business continuity planning
- Retention aligned with legal and regulatory requirements
10. User Security Responsibilities
- Protect account credentials and private keys
- Report suspected security incidents promptly
- Use secure devices and networks
- Log out of shared or public systems
11. Policy Updates
This Security Policy may be updated periodically to reflect changes in technology,
regulations, or threat landscapes. Continued use of the platform indicates acceptance
of the updated policy.
12. Security Contact
To report security vulnerabilities or incidents, contact:
DGC2MHNE@proton.me