Security and data
Linking works on hashes exactly as well as on raw values. So raw values never reach us. Here is what does, how it is kept apart per operator, and what happens when something goes wrong.
Salted HMAC-SHA256 hashes of email, phone, card and wallet. IP address, ASN, device fingerprint (itself a hash), country codes, timestamps, event kind, amounts, and the decision with its reasons.
Email addresses. Phone numbers. Card numbers. Names, dates of birth, documents, addresses. We have no field for them and the SDK does not read your form.
Hashes use a per-deployment secret, so a leaked database cannot be dictionary-attacked back to email addresses.
Your API key decides which operator a request belongs to. Whatever the request body says is ignored. One operator's data cannot be read with another's key, and the test suite proves it on every release.
Sameveil is advisory. Your integration sets a 200 ms timeout and treats a miss as "allow". Our typical response is a few milliseconds; a slow one is a network problem, not a signal about the player. Your signup flow never depends on us being up.
Backends use API keys that never expire and can only score and read. Analysts use personal accounts with Argon2id-hashed passwords, 12-hour sessions, and can be disabled with one command when they leave.
Per-key limits so one operator cannot starve another. Every response carries an X-Request-Id you can quote in a support message, and every request is logged with it.
Hosted in Germany behind Cloudflare with TLS end to end. Snapshots every night with 14-day retention. Reference lists (hosting ASNs, VPN ranges, disposable domains) refreshed from maintained public sources.
The same software ships as a single container. Run it on your own server, point your backend at it, and nothing — not even hashes — leaves your infrastructure. You create the analyst accounts; we never have access. Updates are a new image.
On-prem is the right answer for operators with data-residency obligations or a security team that would rather not add a vendor to the data flow at all.
$ docker compose up -d ✔ sameveil Started $ curl -s localhost:8000/v1/health { "status": "ok", "version": "0.2.1" }
Sameveil is a young product. There is no ISO 27001 certificate yet and no SOC 2 report. There is a small, readable codebase, a test suite that runs before every deploy, and a founder who will answer your security questionnaire line by line. If your procurement needs the certificates, we are probably a year early for you — and we would rather say so now.