Security & Trust

Claims you can check, and plain answers about the rest.

This page lists what is live in our products today, what we are still building, and the evidence you can check yourself. If something has not been independently verified, we say so. For what our records do and don't prove, and how deletion works, see Data integrity & deletion.

Live security feed

What our defense agents are doing right now

Events stream in as they happen. Reviewed milestones and compliance updates are posted by our team below.

Connecting…

Latest 0: 0 pending · 0 resolved

Status changes

Watching for events moving between pending and resolved. Changes appear here as they are recorded.

  • No events to show yet.

Only the agent name, event type, severity, time and status are shown. IP addresses, user IDs, credentials and error details never leave our systems. Severity is the agent's own rating, not a confirmed incident. Pending means the event has not yet been marked resolved in our records; Resolved means it has. The time shown is when the event was first logged.

The Crazy 8 defense agents

Crazy 8 is our security system: eight AI agents, each with one job, working together around the clock to protect Life by IDIA and The IDIA Hub. The number on each card counts that agent's events among the latest 40 above. Descriptions are company-stated and have not been independently assessed.

Sentinel

0

Anomaly detection

Watches live network traffic, API request rates and data streams, and flags unusual usage or behaviour as soon as it appears.

Oracle

0

Predictive threat modelling

Studies past and system-wide signals to forecast new kinds of attack and weak spots before they are used.

Hunter

0

Active threat hunting

Searches endpoint logs, transaction ledgers and database states for hidden threats or unauthorised probing from inside.

Guardian

0

Access control

Keeps every database call within strict role limits, giving each account and service only the access it needs.

Gatekeeper

0

Ingress and egress cleaning

Checks everything coming in and going out, blocking prompt injections, cleaning data streams and stopping fields from being exposed.

Shield

0

Data loss prevention

Holds unverified or older data in quarantine and applies exclusion rules before it can enter the system.

Mirror

0

Adversarial red-teaming

Attacks our own defences on purpose, simulating exploits to find logic gaps before someone malicious does.

Insight

0

Forensic audit trail

Writes readable security incident records and compliance logs that enterprise security teams can review.

Reviewed security updates

No reviewed updates have been published yet.

Defense flow

The path every signal takes

  1. 1

    Activity sources

    API traffic, ledger, roles, keys, intake, quarantine

    e.g. A burst of API calls hits one key.

  2. 2

    Crazy 8 sweep

    Each agent checks its own area every 30 minutes

    e.g. Sentinel flags the burst as unusual.

  3. 3

    AI review

    Only notable signals; no personal data is sent

    e.g. The AI sees counts and timings, not who.

  4. 4

    Severity sort

    Low closes itself; medium and up open a case

    e.g. Rated medium, so a case opens.

  5. 5

    Public feed + detail

    Sanitized live ticker; full detail for security staff

    e.g. You see agent, type, severity, Pending.

  6. 6

    Resolution

    Operator resolves; Insight records the case

    e.g. Key is rotated; the feed shows Resolved.

The "e.g." line follows one illustrative signal through the flow. Company-stated process; not independently assessed.

Security & AI

How we keep identity off the cloud

Identity stays on the device

Company-stated design. Not yet independently assessed.

Device-level identity

Liveness checks and private signing keys are designed to stay in the phone's Apple Secure Enclave, so raw identity is not sent to the cloud.

One-way pseudonyms

Identity markers are replaced with one-way identifiers before data leaves the device. Our cloud works with the identifier, not your name.

Signed permissions

Each data stream you allow carries a signed permission record, tied to the consent hash written when you connected it.

Three kinds of AI, three jobs

Crazy 8 defense agents

Live now

Eight cloud agents watch the platform, each with one job. Their events stream live in the feed below.

Cloud, API and on-chain controls

Database isolation

Row-level security on user tables, so each account reads only its own rows. Designed with NIST SP 800-207 principles in mind; not assessed against it.

Hashed API and MCP keys

API keys are stored hashed, and agent requests are filtered for prompt injection (the OWASP LLM01 risk). Not independently tested.

Quarantine for imported data

Older or bulk data is held apart and cleaned before it can join the Synapse Engine.

Settlement and reserve

USDC payouts on Base, a two-signer DAO Safe, and the IDIA Indemnity Reserve behind the Liability Shield.

Ready for security and procurement review.

Qualified enterprise buyers can request our architecture specifications, data-flow diagrams and licensing framework (Linux Foundation CDLA). No independent security audit has been completed yet; when one is, it will be listed here.

Live vs planned

Status of each feature

FeatureStatus

Connect data sources

Apple Health (iOS), Health Connect (Android), FordConnect, Nest and Strava.

Live now

Consent record per connection

Every connection writes a consent record with an audit hash. You can see it in the Transactions tab.

Live now

Stream status and disconnect

Each source shows how recently it synced (under 6 hours, 6 to 24 hours, or older) and can be disconnected at any time.

Live now

Data streams through API endpoints

Buyers create API keys on the Trading Desk and query consented data streams from their own systems. Prices are worked out on our server, never in the buyer's browser.

Live now

MCP connections for AI agents

Buyers connect AI agents (Claude Desktop, Ollama, Cursor) and choose which Hub tools they can use.

Live now

Best Friend AI

Plain-language questions about the available data, answered with totals worked out on our server.

Live now

Raw data bundles (T-1-P vetted buyers only)

Only released after the buyer passes T-1-P Technical Vetting of their own systems. This is a company procedure, not an independent audit.

Live now

Synapse credits

Buyers prepay credits. Each data purchase or query uses up credits and is written to a credit ledger.

Live now

Contributor payout in USDC and IDIA

Each purchase is split. The contributor share is paid to Life wallets on Base. A person with no wallet yet gets a pending payout instead.

Live now

IDIA Token on Uniswap v4 (Base)

IDIA / USDC pool. Its price moves with the market and is not guaranteed.

Live now

DAO governance screen in Life by IDIA

Proposals, committees, an audit feed and treasury flows in the Gov tab.

Live now

Proposal voting in the Gov tab

Each vote counts voting power at a fixed Base block, shows the tally against its threshold and keeps a voter ledger. The votes so far have been test proposals.

Live now

Committees (Hats)

Committees such as Legal Defense & Jurisdiction and Sociorelational Impact list their active officers and roster in the Gov tab.

Live now

DAO Safe treasury controls

The DAO Safe needs 2 of its 2 signers to approve any move. It owns the token contract, the five allocation vaults and the local DAO pools.

Live now

Local DAO pools

Settlement looks up the pool for a purchase's location in the on-chain registry and sends the DAO share there. The first pool is Louisville-KY-US. The DAO Safe has switched on automatic pool creation, so a new location gets its own pool, owned by the Safe.

Live now

Liability Receipt NFTs on Base

The Liability Receipt NFT is the token inside the Liability Shield. Each data sale mints a soulbound one that records the consent hashes behind it. 282 had been minted by October 21, 2026, the first on June 10, 2026. Anyone can count them on Basescan.

Live now

Liability Shield for data buyers

Covers buyers for consent, identity and breach claims tied to IDIA data, as long as they keep the Liability Receipt NFT ID attached and never re-identify anyone. Backed by $0.25 per credit set aside in IDIA Indemnity Reserve LLC (company-stated). Not insurance.

Live now

Append-only Hub intake ledger

By design, the ledger only accepts new entries. Past entries cannot be edited or deleted.

Live now

In-app Shop / IDIA Pay

Only shown to users once payments are ready for them.

In progress

Independent security assessment

Not done yet. We do not claim any third-party audit or certification. We will publish the scope and results when one is completed.

Planned

Quadratic voting on major proposals

The Operating Agreement (Art. 3.2) calls for it so large holders cannot dominate. We will mark it live once the vote tally uses it.

Planned

Conversion to IDIA DUNA

Happens when the DAO reaches 100 governance members, the minimum under Wyoming's DUNA law.

Planned

501(c)(3) tax-exempt status

A goal. The DAO is set up for charitable purposes, but the IRS has not recognized it as tax-exempt.

Planned

More data sources

More connections beyond the five listed above. We will not name them until they are live.

Planned

Security status

What has been independently checked so far

No third-party security audit or certification completed yet

We do not claim SOC 2, ISO 27001, a penetration test report or any other independent certification. When an independent assessment is done, we will publish who did it, what it covered and when.

Security Addendum

IDIA has a Security Addendum document. Until its scope has been checked, we treat it as a company document. It is not presented here as an independent audit.

Indemnity Reserve & financial coverage

What we cover for data buyers

Liability Shield · IDIA Indemnity Reserve LLC

Live now

Coverage for consent, identity and breach claims, backed by $0.25 from every credit.

Consent and identity claims

A regulator or a person claims that data a buyer got from IDIA was collected or shared without valid consent, or that it exposes who someone is.

Data breaches traced to IDIA data

A buyer suffers a data breach, and data from IDIA is found in it and can be identified as IDIA's through its Liability Receipt NFT and consent records.

How it is funded

$0.25 of every Synapse Credit used is set aside in IDIA Indemnity Reserve LLC, kept apart from IDIA Data Inc.'s operating funds (company-stated). It comes from IDIA's 60% share. Coverage is capped at what the buyer's own use has paid in. Each use gets its own Liability Receipt NFT on Base.

The Liability Receipt NFT is the token inside the Liability Shield. Coverage only applies if the buyer keeps its ID attached to the data and never re-identifies anyone. This is a contractual promise from IDIA, backed by the reserve. It is not an insurance policy or legal advice. How to make a claim is set in each buyer's agreement.

Full conditions and what is not covered

Data governance in the product

How consent works in the product today

A consent record for every connection

Connecting a source writes a consent record with an audit hash. You can see and copy it in the Life by IDIA Transactions tab.

Consent is checked at purchase

When data is bought, the Synapse Engine checks the consent hashes behind every record, and settlement only pays the people those records belong to.

Disconnect any time

You can disconnect any source from the Data page. Data from that source stops flowing in, and personal details that identify you are never sold.

Check it on-chain

Contract addresses on Base

Payouts and the DAO's share move through these addresses. Anyone can look them up on Basescan.

Receipt NFTs · all wallets

Live now

282

Liability Receipt NFTs minted between June 10, 2026 and October 19, 2026. Each one is soulbound and records the consent hashes behind a data sale.

Receipt NFTs · one Life wallet

68

Receipts held by the Life wallet 0x429F7fd3CCd6514Cedef76DB12f7bA2151355A40. You can open the wallet's receipt history on Basescan and see each mint transaction.

View this wallet's receipts on Basescan

Counts read directly from Base on October 21, 2026.

Uniswap — Uniswap v4 · New position. Adding liquidity with IDIA selected, opened from Life by IDIA. This shows the token is tradable; it says nothing about its price.

Real screenshotUniswap

Uniswap v4 · New position

Adding liquidity with IDIA selected, opened from Life by IDIA. This shows the token is tradable; it says nothing about its price.