Security at Ownich
Ownich is digital ownership infrastructure that gives physical items a persistent, verifiable identity, ownership history and provenance record. Its Ownership Passport records the item's ownership, provenance, certificates, evidence and transfers throughout its lifecycle — combining identity, authentication, authorisation, cryptographic integrity, controlled transfers, auditability and privacy-by-design.
Security overview
Ownich is built around the principles of confidentiality, integrity, availability, authentication, authorisation and auditability. Security is embedded throughout the platform — not added after the fact.
Data protection
Personal data is collected only for defined purposes, retained only as long as necessary, and protected in accordance with UK GDPR and the Data Protection Act 2018. Users can access, correct and delete their data.
Encryption
All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256. Passwords are stored using Argon2id — never in plaintext.
Authentication & access control
Ownich uses multi-factor authentication, role-based access control and session management to ensure only authorised users can access protected resources. Permissions are enforced server-side.
API security
All API endpoints require authentication. Rate limiting, input validation and output encoding are applied across the platform. OAuth 2.0 is used for third-party integrations.
Digital certificate security
Each Ownich certificate is assigned a unique cryptographic identifier. Certificate status, ownership history and transfer events are recorded in a tamper-evident audit trail.
Ownership-transfer security
Ownership transfers require explicit authorisation from the current owner. Each transfer is logged with a timestamp, parties involved and verification method. Transfer records cannot be hidden or selectively omitted from the ownership history. In verified cases of dispute or fraud, Ownich administrators may reverse a completed transfer — this action is itself permanently recorded as an audited admin reversal entry.
Infrastructure security
Ownich runs on isolated environments with least-privilege service accounts, automated security patching and a web application firewall. DDoS mitigation and rate limiting protect all public endpoints.
Incident response
Ownich maintains an incident response process covering identification, containment, investigation, remediation, notification and post-incident review. Affected users are notified in accordance with regulatory requirements.
Compliance roadmap
Ownich is designed to align with UK GDPR, the Data Protection Act 2018, PCI DSS (for payment processing) and relevant financial regulations. ISO/IEC 27001 and SOC 2 certification are on the roadmap as the platform scales.
Security & Trust Framework
The full 40-section framework — covering architecture, controls, governance, compliance and more. Available as a gated PDF for enterprise due diligence, investors and strategic partners.
Important: An Ownich certificate is a digital record issued by the platform. It does not automatically establish legal title to every type of physical asset. The legal effect of an ownership record can depend on asset type, applicable law, contractual arrangements, issuing entity, verification requirements and relevant jurisdiction. This distinction is particularly important for vehicles, luxury goods, high-value assets, marketplaces and enterprise use.
Security reporting
If you have identified a potential security vulnerability in the Ownich platform, please report it responsibly. We will acknowledge receipt within 24 hours.
security@ownich.io