Enterprise Security Packet

CAIRL is a privacy-first identity verification platform operated by reAPPlicate Incorporated, a Florida corporation. The platform provides:

• Identity verification using government-issued documents and biometric matching
• Secure encrypted document storage
• OAuth 2.0-based verification claims delivery (PKCE enforced, no raw PII exposure)
• Proxy email services (CAIRL/mail)
• Passkey-first authentication (CAIRL/keys)

CAIRL provides verification signals and infrastructure, not legal identity certification. CAIRL does not act as a financial intermediary, data broker, or custodian of funds.

2.1 Data Minimization

CAIRL is designed to collect only the data necessary to verify identity, prevent fraud, and provide authorized services.

2.2 Claims-Based Architecture

Connected services receive verification claims only (e.g., "age_18_plus: true", "identity_verified: true"). No raw identity documents, biometric data, or full personal details are shared with connected services unless explicitly authorized by the user through a comparison claim.

CAIRL APIs do not expose raw identity documents or biometric data to connected services.

Claims are generated per request and are not reused across services without user authorization.

2.3 Pairwise Identifiers

Each integration receives a unique, non-correlatable identifier (HMAC-SHA256) for each user. Raw user IDs never leave the CAIRL platform. This prevents cross-platform user correlation.

2.4 Biometric Data Handling

3.1 Architecture

3.2 Environment Isolation

Development, staging, and production environments are fully isolated with separate databases, storage buckets, credentials, and access controls. No development data touches production systems.

3.3 Shared Responsibility

Underlying infrastructure providers (AWS, Vercel) operate under a shared responsibility model. CAIRL secures application-layer systems and access controls, while providers secure the underlying cloud infrastructure.

5.1 Internal Access

5.2 User Access

CAIRL maintains internal incident response procedures covering:

• Detection — Monitoring and alerting on anomalous access patterns
• Containment — Isolation of affected systems and credentials
• Remediation — Root cause analysis and patching
• Post-incident review — Documentation and process improvement

Incident response procedures are tested periodically as part of internal security practices.

Breach Notification

CAIRL does not claim certification until audits are complete and the auditor's report is received.

All subprocessors operate under contractual and security obligations consistent with CAIRL's Privacy Policy and Data Processing Agreement. CAIRL remains responsible for the performance of its subprocessors. Material subprocessor changes are communicated with 30 days' notice.

Address: reAPPlicate Incorporated, 3200 NW 62nd Avenue #22, Margate, FL 33063