Technology Stack
Data handling at rest in transit and on chain
Storage
Originals encrypted off chain using AES 256 GCM with KMS or HSM key wrapping and rotation
Pseudonymized merchant identifiers using HMAC SHA256 with rotating secrets
Access control
OIDC or OAuth for service identity
RBAC and ABAC for least privilege
Audit and retention
Change and view logs with export and retention settings
Optional deletion proofs via hash receipts
On chain boundary
Only minimal metadata goes on chain. Sensitive data stays off chain.