Last updated: 12 April 2026
OneAddress is built on a zero-knowledge foundation. We never see your addresses in plaintext. Here's how every layer of the system protects your data.
Because of our zero-knowledge architecture, OneAddress cannot:
Read your addresses, even if compelled by court order — we don't have the decryption keys. Reset your vault PIN — only you know it. Access your vault data on our servers — it's encrypted ciphertext. Read address payloads in transit to partners — they're encrypted with the partner's public key. Modify address data during transmission — HMAC signatures prevent tampering.
⚠ Lost your PIN? Because of our zero-knowledge design, we genuinely cannot recover your encrypted vault data. If you lose your PIN, you can reset your vault from Settings — this permanently deletes your encrypted data and lets you start fresh with a new PIN. Your account (email, payment history) is preserved. We strongly recommend storing your PIN in a secure password manager.
Your vault PIN is required before every address update dispatch. This prevents unauthorised changes even if your account is accessed by someone else. We are integrating government document verification and liveness detection as an additional layer before dispatch — this will be mandatory before public launch.
OneAddress is designed to comply with: the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs); the Notifiable Data Breaches (NDB) scheme; APRA prudential standards for partners in regulated industries; and general data protection best practices. Our zero-knowledge architecture means a data breach of our servers would not expose any plaintext customer addresses.
We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability in OneAddress, email security@oneaddress.io with a clear description and reproduction steps. We aim to acknowledge reports within 2 business days.
In scope: the customer application (oneaddress.io), the partner portal (partners.oneaddress.io), our published partner SDK, and our public API endpoints.
Out of scope: denial-of-service attacks, social engineering of OneAddress staff, physical attacks, and third-party services we depend on (Clerk, Stripe, Neon, Resend, Cloudflare, Global Data, Vercel) — please report issues with those to the providers directly.
Safe harbour: we will not pursue legal action against researchers who act in good faith, do not access customer data beyond what is needed to demonstrate the vulnerability, and give us a reasonable opportunity to remediate before public disclosure.
Bug bounty: we do not currently run a paid bug bounty programme. We will publicly acknowledge researchers who report valid vulnerabilities (with their consent) once the issue has been remediated.
Questions about our security architecture?
security@oneaddress.io