Security & Trust
Claims you can check, and plain answers about the rest.
This page lists what is live in our products today, what we are still building, and the evidence you can check yourself. If something has not been independently verified, we say so. For what our records do and don't prove, and how deletion works, see Data integrity & deletion.
Live security feed
What our defense agents are doing right now
Events stream in as they happen. Reviewed milestones and compliance updates are posted by our team below.
Connecting…
Latest 0: 0 pending · 0 resolved
Status changes
Watching for events moving between pending and resolved. Changes appear here as they are recorded.
- No events to show yet.
Only the agent name, event type, severity, time and status are shown. IP addresses, user IDs, credentials and error details never leave our systems. Severity is the agent's own rating, not a confirmed incident. Pending means the event has not yet been marked resolved in our records; Resolved means it has. The time shown is when the event was first logged.
The Crazy 8 defense agents
Crazy 8 is our security system: eight AI agents, each with one job, working together around the clock to protect Life by IDIA and The IDIA Hub. The number on each card counts that agent's events among the latest 40 above. Descriptions are company-stated and have not been independently assessed.
Sentinel
0Anomaly detection
Watches live network traffic, API request rates and data streams, and flags unusual usage or behaviour as soon as it appears.
Oracle
0Predictive threat modelling
Studies past and system-wide signals to forecast new kinds of attack and weak spots before they are used.
Hunter
0Active threat hunting
Searches endpoint logs, transaction ledgers and database states for hidden threats or unauthorised probing from inside.
Guardian
0Access control
Keeps every database call within strict role limits, giving each account and service only the access it needs.
Gatekeeper
0Ingress and egress cleaning
Checks everything coming in and going out, blocking prompt injections, cleaning data streams and stopping fields from being exposed.
Shield
0Data loss prevention
Holds unverified or older data in quarantine and applies exclusion rules before it can enter the system.
Mirror
0Adversarial red-teaming
Attacks our own defences on purpose, simulating exploits to find logic gaps before someone malicious does.
Insight
0Forensic audit trail
Writes readable security incident records and compliance logs that enterprise security teams can review.
Reviewed security updates
No reviewed updates have been published yet.
Defense flow
The path every signal takes
- 1
Activity sources
API traffic, ledger, roles, keys, intake, quarantine
e.g. A burst of API calls hits one key.
- 2
Crazy 8 sweep
Each agent checks its own area every 30 minutes
e.g. Sentinel flags the burst as unusual.
- 3
AI review
Only notable signals; no personal data is sent
e.g. The AI sees counts and timings, not who.
- 4
Severity sort
Low closes itself; medium and up open a case
e.g. Rated medium, so a case opens.
- 5
Public feed + detail
Sanitized live ticker; full detail for security staff
e.g. You see agent, type, severity, Pending.
- 6
Resolution
Operator resolves; Insight records the case
e.g. Key is rotated; the feed shows Resolved.
The "e.g." line follows one illustrative signal through the flow. Company-stated process; not independently assessed.
Security & AI
How we keep identity off the cloud
Identity stays on the device
Company-stated design. Not yet independently assessed.
Device-level identity
Liveness checks and private signing keys are designed to stay in the phone's Apple Secure Enclave, so raw identity is not sent to the cloud.
One-way pseudonyms
Identity markers are replaced with one-way identifiers before data leaves the device. Our cloud works with the identifier, not your name.
Signed permissions
Each data stream you allow carries a signed permission record, tied to the consent hash written when you connected it.
Three kinds of AI, three jobs
Crazy 8 defense agents
Live nowEight cloud agents watch the platform, each with one job. Their events stream live in the feed below.
Cloud, API and on-chain controls
Database isolation
Row-level security on user tables, so each account reads only its own rows. Designed with NIST SP 800-207 principles in mind; not assessed against it.
Hashed API and MCP keys
API keys are stored hashed, and agent requests are filtered for prompt injection (the OWASP LLM01 risk). Not independently tested.
Quarantine for imported data
Older or bulk data is held apart and cleaned before it can join the Synapse Engine.
Settlement and reserve
USDC payouts on Base, a two-signer DAO Safe, and the IDIA Indemnity Reserve behind the Liability Shield.
Ready for security and procurement review.
Qualified enterprise buyers can request our architecture specifications, data-flow diagrams and licensing framework (Linux Foundation CDLA). No independent security audit has been completed yet; when one is, it will be listed here.
Live vs planned
Status of each feature
| Feature | Where | Status |
|---|---|---|
Connect data sources Apple Health (iOS), Health Connect (Android), FordConnect, Nest and Strava. | Life by IDIA | Live now |
Consent record per connection Every connection writes a consent record with an audit hash. You can see it in the Transactions tab. | Life by IDIA | Live now |
Stream status and disconnect Each source shows how recently it synced (under 6 hours, 6 to 24 hours, or older) and can be disconnected at any time. | Life by IDIA | Live now |
Data streams through API endpoints Buyers create API keys on the Trading Desk and query consented data streams from their own systems. Prices are worked out on our server, never in the buyer's browser. | The IDIA Hub | Live now |
MCP connections for AI agents Buyers connect AI agents (Claude Desktop, Ollama, Cursor) and choose which Hub tools they can use. | The IDIA Hub | Live now |
Best Friend AI Plain-language questions about the available data, answered with totals worked out on our server. | The IDIA Hub | Live now |
Raw data bundles (T-1-P vetted buyers only) Only released after the buyer passes T-1-P Technical Vetting of their own systems. This is a company procedure, not an independent audit. | The IDIA Hub | Live now |
Synapse credits Buyers prepay credits. Each data purchase or query uses up credits and is written to a credit ledger. | The IDIA Hub | Live now |
Contributor payout in USDC and IDIA Each purchase is split. The contributor share is paid to Life wallets on Base. A person with no wallet yet gets a pending payout instead. | Settlement | Live now |
IDIA Token on Uniswap v4 (Base) IDIA / USDC pool. Its price moves with the market and is not guaranteed. | Token | Live now |
DAO governance screen in Life by IDIA Proposals, committees, an audit feed and treasury flows in the Gov tab. | Governance | Live now |
Proposal voting in the Gov tab Each vote counts voting power at a fixed Base block, shows the tally against its threshold and keeps a voter ledger. The votes so far have been test proposals. | Governance | Live now |
Committees (Hats) Committees such as Legal Defense & Jurisdiction and Sociorelational Impact list their active officers and roster in the Gov tab. | Governance | Live now |
DAO Safe treasury controls The DAO Safe needs 2 of its 2 signers to approve any move. It owns the token contract, the five allocation vaults and the local DAO pools. | Governance | Live now |
Local DAO pools Settlement looks up the pool for a purchase's location in the on-chain registry and sends the DAO share there. The first pool is Louisville-KY-US. The DAO Safe has switched on automatic pool creation, so a new location gets its own pool, owned by the Safe. | Governance | Live now |
Liability Receipt NFTs on Base The Liability Receipt NFT is the token inside the Liability Shield. Each data sale mints a soulbound one that records the consent hashes behind it. 282 had been minted by October 21, 2026, the first on June 10, 2026. Anyone can count them on Basescan. | Evidence | Live now |
Liability Shield for data buyers Covers buyers for consent, identity and breach claims tied to IDIA data, as long as they keep the Liability Receipt NFT ID attached and never re-identify anyone. Backed by $0.25 per credit set aside in IDIA Indemnity Reserve LLC (company-stated). Not insurance. | Evidence | Live now |
Append-only Hub intake ledger By design, the ledger only accepts new entries. Past entries cannot be edited or deleted. | Evidence | Live now |
In-app Shop / IDIA Pay Only shown to users once payments are ready for them. | Life by IDIA | In progress |
Independent security assessment Not done yet. We do not claim any third-party audit or certification. We will publish the scope and results when one is completed. | Evidence | Planned |
Quadratic voting on major proposals The Operating Agreement (Art. 3.2) calls for it so large holders cannot dominate. We will mark it live once the vote tally uses it. | Governance | Planned |
Conversion to IDIA DUNA Happens when the DAO reaches 100 governance members, the minimum under Wyoming's DUNA law. | Governance | Planned |
501(c)(3) tax-exempt status A goal. The DAO is set up for charitable purposes, but the IRS has not recognized it as tax-exempt. | Governance | Planned |
More data sources More connections beyond the five listed above. We will not name them until they are live. | Life by IDIA | Planned |
Security status
What has been independently checked so far
No third-party security audit or certification completed yet
We do not claim SOC 2, ISO 27001, a penetration test report or any other independent certification. When an independent assessment is done, we will publish who did it, what it covered and when.
Security Addendum
IDIA has a Security Addendum document. Until its scope has been checked, we treat it as a company document. It is not presented here as an independent audit.
Indemnity Reserve & financial coverage
What we cover for data buyers
Liability Shield · IDIA Indemnity Reserve LLC
Coverage for consent, identity and breach claims, backed by $0.25 from every credit.
Consent and identity claims
A regulator or a person claims that data a buyer got from IDIA was collected or shared without valid consent, or that it exposes who someone is.
Data breaches traced to IDIA data
A buyer suffers a data breach, and data from IDIA is found in it and can be identified as IDIA's through its Liability Receipt NFT and consent records.
How it is funded
$0.25 of every Synapse Credit used is set aside in IDIA Indemnity Reserve LLC, kept apart from IDIA Data Inc.'s operating funds (company-stated). It comes from IDIA's 60% share. Coverage is capped at what the buyer's own use has paid in. Each use gets its own Liability Receipt NFT on Base.
The Liability Receipt NFT is the token inside the Liability Shield. Coverage only applies if the buyer keeps its ID attached to the data and never re-identifies anyone. This is a contractual promise from IDIA, backed by the reserve. It is not an insurance policy or legal advice. How to make a claim is set in each buyer's agreement.
Full conditions and what is not coveredData governance in the product
How consent works in the product today
A consent record for every connection
Connecting a source writes a consent record with an audit hash. You can see and copy it in the Life by IDIA Transactions tab.
Consent is checked at purchase
When data is bought, the Synapse Engine checks the consent hashes behind every record, and settlement only pays the people those records belong to.
Disconnect any time
You can disconnect any source from the Data page. Data from that source stops flowing in, and personal details that identify you are never sold.
Check it on-chain
Contract addresses on Base
Payouts and the DAO's share move through these addresses. Anyone can look them up on Basescan.
- 0x6526F939D257E67896821c25B6C24Daa404a01FB
IDIA Token (ERC-20)
Royalty token paid alongside USDC. Traded on Uniswap v4 (Base).
- 0x0910EF34C9F59A90d90FF505B1036DEed4a25d59
IDIA DAO Safe
Owns every local DAO pool. Gets the DAO share directly when a purchase has no location.
- 0x8a0D07b6133247B9d35010646A2E684cFd9875ce
Louisville DAO pool (Louisville-KY-US)
First local DAO pool. Registered on-chain under the location Louisville-KY-US and owned by the DAO Safe.
- 0x45BC46e0C52f2d1d2c22BC267Eb5D27c42B8E5f8
Protocol Registry
Maps each location to its local DAO pool. Settlement looks up the pool here.
- 0x5eA57335f7086f1C069d769a9012835B80a00BD3
IDIA Liability Receipt (NFT)
Soulbound receipt NFTs (IDIA-LR). Each one records the consent hashes behind a data sale on-chain.
- 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
USDC on Base (Circle)
The stablecoin contributor payouts are paid in.
Receipt NFTs · all wallets
Live now282
Liability Receipt NFTs minted between June 10, 2026 and October 19, 2026. Each one is soulbound and records the consent hashes behind a data sale.
Receipt NFTs · one Life wallet
68
Receipts held by the Life wallet 0x429F7fd3CCd6514Cedef76DB12f7bA2151355A40. You can open the wallet's receipt history on Basescan and see each mint transaction.
View this wallet's receipts on BasescanCounts read directly from Base on October 21, 2026.

Real screenshotUniswap
Uniswap v4 · New position
Adding liquidity with IDIA selected, opened from Life by IDIA. This shows the token is tradable; it says nothing about its price.