Security and privacy¶

eAkto handles identity, contact, government-document, and journey data. Treat all citizen data as sensitive and minimize what is collected, retained, logged, and shared.

Trust boundaries¶

Citizen browser/app
       │ HTTPS
       ▼
eAkto API ───── authorized identity and AI providers
       │
       ├──── application database
       └──── private document storage

The Flutter application is an untrusted public client. It may contain public identifiers, but never partner secrets, server API credentials, database keys, or signing material.

Secret handling¶

• Load backend secrets from a secrets manager or process environment.
• Commit only .env.example with blank or unmistakably fake values.
• Never place secrets in --dart-define, Flutter assets, web JavaScript, QR codes, logs, screenshots, or documentation.
• Rotate a credential immediately if it enters Git history; deleting the file in a later commit is not sufficient.
• Keep private keys outside the repository and restrict filesystem permissions.

See Configuration reference for variable names and sensitivity.

Authentication and authorization¶

An authenticated route must validate the eAkto session and then enforce resource ownership. High-assurance actions additionally require a current identity assurance record.

Apply these checks to:

• journey creation and mutation;
• document catalog and vault operations;
• consent and extraction;
• signed URL generation;
• agent status, debug, and continuation endpoints;
• any response containing citizen-specific state.

Document protection¶

• Use a private storage bucket.
• Store object paths and metadata in the database; return short-lived signed URLs only after authorization.
• Validate file size, declared type, detected type, and extension.
• Scan uploads before downstream processing.
• Do not expose provider extraction output to another user or journey.
• Record explicit consent and purpose before extraction or sharing.

Logging and observability¶

Use structured logs with a request/correlation ID. Redact:

• authorization and cookie headers;
• provider tokens and exchange codes;
• QR contents and liveness session data;
• full names, addresses, birth dates, phone numbers, and emails;
• document contents and signed URLs.

Record security events such as denied ownership checks, repeated authentication failures, and assurance expiry without storing the rejected secret.

Privacy by design¶

Collect only fields needed for the selected journey. Define retention and deletion rules before production, lock profile attributes that are authoritative from eGovPH, and provide a traceable consent history. Deployment owners remain responsible for validating compliance with applicable Philippine privacy rules and provider agreements.

Provider specifications supplied through authorized eGovPH channels are restricted integration material. This site intentionally documents eAkto-owned behavior rather than reproducing those specifications.