> For the complete documentation index, see [llms.txt](https://onex-3.gitbook.io/onex-document/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://onex-3.gitbook.io/onex-document/privacy-compliance.md).

# Privacy compliance

## 10.1 Privacy Architecture

ONEx implements privacy as an architectural property. The technical design makes it impossible for ONEx or any third party to access user data without explicit cryptographic consent.

| Data Type            | Where It Lives              | Who Can Access                   |
| -------------------- | --------------------------- | -------------------------------- |
| Transaction history  | User-encrypted vault (IPFS) | User only (with AES-256-GCM key) |
| Biometric data       | Device secure enclave       | Never leaves device              |
| Credit model inputs  | Device only                 | Never transmitted                |
| Behavioral patterns  | On-device model             | Gradient only (with DP noise)    |
| Identity credentials | User's DID wallet           | User controls all sharing        |
| Communication        | End-to-end encrypted        | Sender and receiver only         |

***

## 10.2 Zero-Knowledge Proof System

ONEx uses ZK proofs for three distinct purposes:

### 1. Identity Verification (without data disclosure)

Prove you are over 18, a resident of a jurisdiction, or hold a particular credential — without revealing your name, date of birth, or any underlying document.

### 2. Credit Scoring (zkML)

Prove your credit score is 742 without revealing a single transaction. The lender verifies the on-chain proof — mathematical certainty, zero data exposure.

### 3. Compliance Proofs

Prove a transaction is not associated with sanctioned addresses or illicit funds, without revealing the transaction details to any third party.

**Proof systems used:**

* **Groth16 (Circom/SnarkJS):** Fast, small proof size — used for identity verification
* **Plonky2/STARKs:** No trusted setup required — used for credit scoring and compliance
* **ezkl framework:** ZK-proven ONNX model inference — used for zkML credit engine

***

## 10.3 Post-Quantum Identity

ONEx's decentralized identity system is secured against quantum computers:

| Component      | Classical        | Post-Quantum                       |
| -------------- | ---------------- | ---------------------------------- |
| Key exchange   | ECDH (secp256k1) | CRYSTALS-Kyber (NIST FIPS 203)     |
| Signatures     | ECDSA            | CRYSTALS-Dilithium (NIST FIPS 204) |
| Hash functions | SHA-256          | SHA-3 / BLAKE3 (quantum-resistant) |

The system uses a **hybrid approach** — both classical and PQC signatures are required. This means the system remains secure even if either the classical or PQC algorithm is broken.

***

## 10.4 Compliance Framework

### 10.4.1 KYC Tier System

| Tier              | Requirements               | Limits                               |
| ----------------- | -------------------------- | ------------------------------------ |
| Tier 0 (No KYC)   | Wallet address only        | Crypto-only, limits per jurisdiction |
| Tier 1 (Basic)    | Phone + email verification | Low fiat limits                      |
| Tier 2 (Standard) | Government ID + selfie     | Standard limits                      |
| Tier 3 (Enhanced) | Full KYC + source of funds | Institutional limits                 |

KYC is performed by licensed third-party providers (Jumio, Onfido, or equivalent) — ONEx does not store raw KYC documents.

### 10.4.2 Regulatory Framework

| Regulation       | Implementation                                                             |
| ---------------- | -------------------------------------------------------------------------- |
| FATF Travel Rule | Automatic for transactions ≥$1,000 (USD equivalent, jurisdiction-adjusted) |
| MiCA (EU)        | Full compliance reporting package                                          |
| FinCEN (US)      | Bank Secrecy Act compliance via licensed partner                           |
| GDPR / CCPA      | Consent manager + data portability engine + right to deletion              |
| OFAC Sanctions   | Real-time screening on every transaction                                   |

**Geo-Adaptive Regulation Engine:** Rules adapt automatically to the user's jurisdiction. Changes require mandatory legal review before rule deployment — the engine cannot automatically apply novel legal interpretations without human review.