Technical Documentation

Security Whitepaper

A technical overview of the forensic protection layers, integrity mechanisms, and traceability architecture powering Veridian Vault.

visibility_off

Invisible Forensics

UUID fragments distributed across every page using deterministic hash-based positioning.

fingerprint

HMAC Integrity

SHA-256 HMAC signature computed on the final PDF output, stored in document metadata.

track_changes

Immutable Ledger

Every stamp event is recorded with timestamp, IP, and email hash in a tamper-resistant log.

Watermark Architecture — 3 Layers

1

Visible Watermark (optional)

A semi-transparent text layer applied to footer or diagonally across each page. Opacity is configurable (30% discreet / 50% normal / 80% visible). Font: Helvetica at 8–12pt.

2

Distributed Invisible Stamp

The document UUID (RFC 4122 v4) is fragmented and distributed across all pages. Each fragment is placed at coordinates derived from hash(uuid + pageNo + i), rendered at 4pt in RGB(210,210,210) with a slight rotation. Redundant copies ensure recovery from partial document fragments.

3

Micro-tiling (email, margins)

The recipient email is rendered in 3pt text at 12 fixed positions in page margins (top, bottom, left, right). Color: RGB(200,200,200). Survives JPEG compression and screenshot capture.

Public ID & Verification

Each protected document receives a Public ID computed as HMAC-SHA256(uuid, hmac_key). This ID is safe to share publicly — it cannot be reversed to obtain the internal UUID.

Verification uses hash_equals() for timing-safe comparison, preventing timing attacks on the traceability index.

Security Headers & Transport

X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-XSS-Protection 1; mode=block
Referrer-Policy strict-origin-when-cross-origin
Rate Limiting 20 stamps/h (free), 30 verifs/h
mail Security Enquiries