Built like a bank would demand

Government ID images stay with Shufti Pro (or your approved IDV). Identity Inc. stores applicant ids, status, content hashes, and verifiable credentials we issue — not a document vault.

• Scoped API keys + optional HMAC request signing
• Per-tenant IP allowlists
• Hash-chained audit log with export + verify
• AML suspend / escalate with evidence
• Anti-abuse velocity, device graphs, progressive trust

Full control mapping: BoundIdentity docs/INSTITUTIONAL.md and docs/SECURITY.md.