Security at NearAuth.ai

Last updated October 29, 2026

For security reviewers: this page collects what you'll need in one place. The short version: no passwords or biometrics ever reach us, every phone and computer proves itself with a key locked in its own hardware, and our SOC 2 Type I audit is in progress. For anything not covered here, email security@nearauth.ai and we'll send our completed security questionnaire.

At a glance

Topic	Status
SOC 2	Type I audit in progress
Security questionnaire	Completed Cloud Security Alliance CAIQ, available on request
Hosting	Google Cloud, United States (us-central1, Iowa)
Encryption	TLS for all connections; encrypted at rest
Passwords and biometrics	Never collected
Device keys	Held in each device's secure hardware; never leave the device
Staff access to production	Named accounts only, with two-factor authentication
Log retention	90 days, with secrets removed before logs are written
Breach notification	Affected customers told without undue delay, within 72 hours of confirming a breach
Service status	status.nearauth.ai

How sign-in is protected

NearAuth.ai signs a person in only while their own registered phone is next to their own registered computer. The two devices confirm it with an encrypted Bluetooth exchange, and our server checks the result, again and again through the day. When the phone leaves, access ends.

Nothing to phish. There are no codes to type and no push notifications to approve, so there's nothing for a fake login page to relay or for a caller to talk someone into.
Hardware-held keys. Each phone and computer has its own private key, kept in its secure hardware (the iPhone's Secure Enclave, Android's hardware keystore). The key never leaves the device.
Checked at setup. When a phone is registered, Apple App Attest or Android Key Attestation confirms it's our real app on a real device.
Signed requests. Every request from our apps is signed by that device's key. A copied request sent from another machine is refused.
Biometrics stay on the phone. When Face ID, Touch ID or a fingerprint is needed, the check happens inside the phone, which tells us only that it passed.

How your data is protected

Collected: only what's needed to make the sign-in decision. The full list, with how long each item is kept, is on What NearAuth.ai Knows About You.
Where: Google Cloud in the United States (us-central1, Iowa). Google's data centers are covered by Google's own SOC 2 and ISO 27001 certifications. We run no data centers of our own.
In transit and at rest: TLS for every connection, and data encrypted at rest.
Isolation: every query is limited to the customer's own company, and administration is role-based.
Backups: automated database backups, kept for at least 7 days and then overwritten.
Who processes it: the companies that help us run the service, what they do and where, are on our subprocessors page. We give 30 days' notice before adding or replacing one.

How we run things

Access: only named NearAuth.ai staff, signed in with two-factor authentication, can reach production.
Logging: sign-in, device and admin events are logged with the time, user, device and IP address. Secrets are removed from log lines before they're written, and logs are deleted after 90 days.
Safe rollouts: new sign-in protections ship switched off, and each customer turns them on when they're ready.
Testing: internal security reviews of the service and apps, and automated tests for security-critical code. Findings are tracked until they're fixed.
Incidents: we post updates on status.nearauth.ai, and notify affected customers of a personal-data breach within 72 hours of confirming it.

Compliance and documents

Item	How to get it
SOC 2 Type I	Audit in progress. We'll share the report when it's issued.
Completed CAIQ (CSA security questionnaire)	Email security@nearauth.ai
Your own security questionnaire	Send it to security@nearauth.ai. We'll fill it in.
Data Processing Agreement	Included in customer agreements; email privacy@nearauth.ai
Privacy Policy	nearauth.ai/privacy
What we collect, in plain English	nearauth.ai/data-privacy
Subprocessors	nearauth.ai/subprocessors

What NearAuth.ai doesn't do

We'd rather you hear the limits from us:

If someone is talked into signing in at their own desk, with their own phone next to it, no second factor can tell that apart from a normal sign-in. Training and good help-desk checks still matter.
Every employee needs the NearAuth.ai app on their phone and computer, with Bluetooth on.
We don't yet hold a SOC 2 report or other third-party certification. The audit is under way, and we'll update this page when it's done.

Report a vulnerability

If you think you've found a security problem in NearAuth.ai, email security@nearauth.ai with "Security report" in the subject. Please give us a reasonable chance to fix it before telling anyone else, and don't access other people's data or disrupt the service while testing. We'll reply within 3 business days and keep you updated until it's fixed. Our contact details are also in security.txt.

See also: What we collect • Privacy Policy • Subprocessors