Security
Privacy Guarantees
Privacy at Althea is enforced by design, not policy. There is almost nothing to leak because there is almost nothing stored. This page walks through every byte of data that touches the system and where it goes.
What data flows where
| Stage | Data | Where it lives | Lifespan |
|---|---|---|---|
| Form entry | NIN/BVN, DOB | User's browser, your form state | Until form submit |
| POST /api/verify | NIN/BVN, DOB | In transit over HTTPS | Single request |
| Dojah call | NIN/BVN | Althea backend → Dojah | Single request |
| Backend signing | Plaintext ID | Backend memory only | ≈ 50–200ms then GC |
| SignedCredential | Poseidon hash + signature | Browser memory | Until generateProof() wipes it |
| ZK proof | Mathematical artefact | Browser memory → Solana | Permanent on-chain (no personal data) |
| On-chain | Nullifier + Attestation | Solana PDAs | Permanent |
What Althea stores
Nothing personal. Nothing reversible. Nothing.
- Althea backend — no database. Each request opens a memory-only handler, makes one Dojah call, signs one credential, returns. There is no logger that writes the body.
- Althea on-chain program — stores two PDAs per verified user: a nullifier (one-way hash of a hash) and an attestation flag with a timestamp. Neither reveals identity.
- Your dApp — only what you choose to store. The SDK gives you a boolean. We strongly recommend storing only the wallet address and its attestation status.
The nullifier — what it reveals and what it doesn't
The nullifier is Poseidon(Poseidon(NIN)). Given a nullifier, you cannot recover the inner hash, let alone the NIN itself. What you can do: check whether a specific nullifier has registered.
This means a determined observer who already knows a candidate NIN could test whether that NIN has been used by computing the same hash chain. Althea accepts this trade-off because it's the only way to enforce one-identity-one-wallet without storing identity.
Compared with traditional KYC
| Concern | Traditional dApp KYC | Althea |
|---|---|---|
| NIN stored at rest | Yes — in dApp DB | No — anywhere |
| NIN seen by dApp | Yes | No |
| NIN visible in logs | Often, accidentally | Never — no logger touches it |
| Linkable across dApps | Yes, via the NIN | Only via the nullifier, which is a hash-of-hash |
| Recovery from a breach | Notification + lifelong risk | Nothing to breach |
Privacy as a property, not a promise
Althea's privacy is enforced by cryptography and by code absence. Even a malicious Althea operator with full server access cannot retroactively learn which NIN belongs to which wallet — the link doesn't exist anywhere to be discovered.