> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idemeum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security overview

> Security is the fundamental block of our platform.

## How idemeum is architected

<AccordionGroup>
  <Accordion title="Logins with MFA">
    Every login is multi-factor, using the combination of biometrics and certificates.
  </Accordion>

  <Accordion title="FIDO2 compliant">
    Idemeum mobile app implements MFA based on modern [FIDO2 standards](https://fidoalliance.org/fido2/?ref=docs.idemeum.com).
  </Accordion>

  <Accordion title="Distributed storage">
    Sensitive data, such as break-glass credentials, can be accessed offline on mobile and can be pushed to external systems.
  </Accordion>

  <Accordion title="Device recovery">
    When encryption keys are lost, recovery can be performed using the emergency key, or with approval by other technicians.
  </Accordion>

  <Accordion title="Device compliance checks">
    Validate the compliance of devices using Android and iOS built-in security and signing certificates before granting access to idemeum portal.
  </Accordion>

  <Accordion title="Multiple encryption layers">
    Transmitted data is encrypted multiple times, authenticated by both transport layer security (TLS) and the user-managed transit symmetric and asymmetric cryptography keys.
  </Accordion>

  <Accordion title="Hardware backed storage">
    Mobile crypto keys are stored leveraging [Strongbox](https://developer.android.com/privacy-and-security/keystore?ref=docs.idemeum.com) or [iOS security enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web?ref=docs.idemeum.com) on Android and iOS.
  </Accordion>

  <Accordion title="API key encryption">
    Even when enabling API integrations to perform automated actions on vault data, all encryption is performed with security API key that is not persisted in the cloud.
  </Accordion>

  <Accordion title="Data security">
    Idemeum is designed with end-to-end encryption (E2EE) principles. What that means is that when the desktop agent is installed, the encryption key is passed and kept on the desktop. All sensitive information is encrypted with that key, before it goes to the idemeum cloud. Idemeum team is not able to see information such as passwords and sensitive credentials. Even if idemeum cloud is compromised, the sensitive information will not be exposed.
  </Accordion>
</AccordionGroup>

## Compliance

Idemeum is SOC2 Type 2 certified.

<img src="https://mintcdn.com/idemeum/2xPZ_X8cEkDijBHc/images/soc.png?fit=max&auto=format&n=2xPZ_X8cEkDijBHc&q=85&s=6e5bd708e52ce077f3d3551c9130cec2" alt="Soc" title="Soc" style={{ width:"36%" }} width="1463" height="1463" data-path="images/soc.png" />