Last updated: 27 May 2026
OneAddress is built on a zero-knowledge foundation. Your addresses are encrypted in your browser before they reach our servers, and partner payloads are encrypted with each partner's own key. Here's how every layer of the system protects your data.
Because of our zero-knowledge architecture, OneAddress cannot:
Read your addresses, even if compelled by court order — we don't have the decryption keys. Reset your vault PIN — only you know it. Access your vault data on our servers — it's encrypted ciphertext. Read the plaintext address payload after it is encrypted for a partner — it is encrypted with the partner's public key before leaving your browser. Modify address data during transmission — HMAC signatures detect tampering.
⚠ Lost your PIN? Because of our zero-knowledge design, we genuinely cannot recover your encrypted vault data. If you lose your PIN, you can reset your vault from Settings — this permanently deletes your encrypted data and lets you start fresh with a new PIN. Your account (email, payment history) is preserved. We strongly recommend storing your PIN in a secure password manager.
A government-document verification with a liveness selfie is mandatory before every address dispatch, on both the account and guest flows. It is performed by Global Data Pty Ltd, an Australian-accredited identity service provider based in Melbourne, and includes a Document Verification Service (DVS) cross-check with the issuing authority. One successful verification authorises exactly one address transmission; the next update requires a fresh check. On the account flow your vault PIN is also re-entered immediately before dispatch, so an attacker who somehow obtained your session would still be blocked by both your PIN and a fresh ID check. Full data-handling detail is in our Privacy Policy section 6.
OneAddress is designed to comply with: the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs); the Notifiable Data Breaches (NDB) scheme; and general data protection best practices. Some of our partner organisations are subject to APRA prudential standards and financial-sector security requirements in their own right — our webhook security model (HMAC-SHA256 signing, ±5-minute replay window, ECDH per-partner key isolation) is designed to meet the security expectations those partners face. Our zero-knowledge architecture means a breach of our database would not expose any plaintext customer addresses.
We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability in OneAddress, email security@oneaddress.io with a clear description and reproduction steps. We aim to acknowledge reports within 2 business days.
In scope: the customer application (oneaddress.io), the partner portal (partners.oneaddress.io), our published partner SDK, and our public API endpoints.
Out of scope: denial-of-service attacks, social engineering of OneAddress staff, physical attacks, and third-party services we depend on (Stripe, Neon, Resend, Cloudflare, Global Data, Vercel) — please report issues with those to the providers directly.
Safe harbour: we will not pursue legal action against researchers who act in good faith, do not access customer data beyond what is needed to demonstrate the vulnerability, and give us a reasonable opportunity to remediate before public disclosure.
Bug bounty: we do not currently run a paid bug bounty programme. We will publicly acknowledge researchers who report valid vulnerabilities (with their consent) once the issue has been remediated.
Questions about our security architecture?
security@oneaddress.io