Security Policy
Overview of security governance and technical safeguards for DoorAPI.
Customer-specific agreements, order forms and mandatory law may override these general provisions.
Governance
Doorsecure maintains ISO 27001 and ISO 9001 certified management systems. Security responsibilities, risk management, access controls, change management, incident response and continuous improvement are governed through these systems.
Encryption
DoorAPI uses TLS 1.3 for supported service communications. Data at rest, object storage and backups use AES-256 encryption.
Identity and access
MFA is available. Users can manage active sessions. Customers can create, scope, rotate and revoke API keys without Doorsecure intervention, including multi-tenant scopes where supported.
Infrastructure
Core workloads run on Kubernetes infrastructure managed with TrueFullstaq in European data centres. Doorsecure deliberately avoids AWS for core DoorAPI hosting.
Operations
Doorsecure uses monitoring, controlled deployments, logging, vulnerability management, backup, geographic redundancy and recovery procedures. Sensitive implementation details are not disclosed publicly where that would reduce security.
Devices and biometrics
Device communication, firmware history and access events are controlled platform functions. Optional facial images may also be available locally on configured terminals for fallback; customers control activation and lawful use.
Security contact
Report suspected vulnerabilities to security@doorsecure.com using the Responsible Disclosure process.