> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.idenfy.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Compliance
> Review iDenfy certifications, security standards, and regulatory compliance including ISO 27001, SOC 2 Type II, eIDAS, and GDPR readiness.
Trust is the foundation of identity verification. iDenfy is built to meet the strictest regulatory and security standards so you can verify identities with confidence.
***
## Certifications & Standards
### ISO/IEC 27001:2022
Continuously certified since 2020. iDenfy holds an ISO/IEC 27001:2022 certificate (No. 1512120135) issued by TÜV Thüringen under DAkkS accreditation. This certificate covers the development and provision of identity and business verification, fraud prevention and Anti-Money Laundering software. Our most recent surveillance audit found zero non-conformities.
### SOC 2 Type II
Independently audited for security, availability and confidentiality. iDenfy's SOC 2 Type II report covers a full 12-month examination period, certified by House of CPA. The report confirms that our controls are properly designed and operate effectively over time. It provides customers and their auditors with documented assurance on how we handle and store data in production.
### eIDAS Conformity
Certified for remote identity proofing under EU regulation. iDenfy holds an eIDAS Declaration of Conformity (No. eIDAS250020) issued by the Electrotechnical Testing Institute (EZU) in Prague, covering remote ID proofing using video identification assessed against Regulation (EU) No. 910/2014, ETSI TS 119 461, and ISO/IEC 30107-3:2023. This makes iDenfy one of the few identity verification providers certified to the highest European standards for electronic identification and trust services.
### GDPR
Fully compliant with the EU General Data Protection Regulation (2016/679). Designated Data Protection Officer, documented Data Processing Agreement (DPA), and all personal data stored within the EU.
***
## How iDenfy Handles Compliance
### Data Processing
| Area | How we handle it |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Data minimization** | Only required data fields are collected per your verification configuration. We process only what is necessary for the verification purpose. |
| **Processing locations** | All data is processed and stored on Amazon AWS Europe (Dublin, Ireland). Data is not transferred outside the EU unless Standard Contractual Clauses are in place. |
| **Data residency** | EU-based infrastructure by default. Configurable data residency options available upon request. |
| **Retention** | Configurable retention periods with automatic deletion. Default retention follows regulatory requirements (up to 10 years for AML-related records). Customer accounts are removed 60 days after closure. |
| **Sub-processors** | All sub-processors are documented, contractually bound, and subject to equivalent data protection obligations. Amazon AWS operates under a carve-out approach in our SOC 2 report. |
| **Data subject requests** | Responded to within 30 days per GDPR. Customers can export their data at any time before account closure. |
### Audit Trail
Every verification produces a complete audit trail including:
* Timestamp of each verification step
* Document images and extracted data (OCR, MRZ)
* Liveness check results with anti-spoofing analysis
* Face matching results (document photo vs. selfie)
* AML screening results (PEP, sanctions, adverse media)
* Manual review decisions by in-house KYC experts (if applicable)
* Downloadable PDF verification reports for your compliance records
All audit logs are protected with read-only access, file integrity monitoring, and retention of up to 10 years for critical records.
### Security Measures
| Measure | Detail |
| ---------------------------- | ------------------------------------------------------------------------------------------ |
| **Encryption in transit** | TLS 1.2-1.3 on all connections |
| **Encryption at rest** | AES-256-GCM on all stored data (databases, object storage, volumes, backups) |
| **Key management** | Managed key service with automatic rotation at least every 12 months |
| **Callback signing** | [Webhook payloads signed](/security/callback-signing) to ensure integrity and authenticity |
| **API access control** | [IP whitelisting](/security/ip-whitelisting) available for API access restriction |
| **Web Application Firewall** | WAF with anti-DDoS protection |
| **Intrusion detection** | Endpoint detection and response (EDR) with cloud-native threat monitoring |
| **Network security** | Default deny-all firewall rules; only business-justified traffic permitted |
| **Vulnerability management** | Continuous automated scanning and regular penetration testing |
| **Vulnerability SLAs** | Critical: 48 hours. High: 7 days. Medium: 1 month |
### Incident Response
* Dedicated Incident Response Team (CEO, Security Officer, CTO)
* Response SLAs from immediate (catastrophic) to 2-3 business days (insignificant)
* Client breach notification within 8-24 hours of occurrence
* Data Protection Authority notification within 72 hours
* Root cause analysis and post-incident review after every incident
* Incident Response Plan tested annually
* Zero security incidents in the past 12 months
### Secure Development
* Agile/Scrum methodology with security integrated into every sprint
* All code reviewed via pull requests by engineers trained in secure coding
* Reviewed against OWASP Top 10 and SANS attack patterns
* Vulnerability scanning before every production deployment
* Separate development, staging, and production environments
* Production data never used in test/dev environments
* Annual secure coding training (OWASP principles) for all engineers
***
## Data Protection Roles
iDenfy acts as a **Data Processor** when performing identity verification on behalf of clients. Your organization remains the Data Controller and determines the purposes and legal bases for processing.
iDenfy acts as a **Data Controller** only for its own website, marketing, and recruitment activities.
A standard Data Processing Agreement (DPA) is available for all customers.
***
## Mapping Features to Requirements
| Requirement | iDenfy Feature | Relevant Framework |
| ----------------------------- | ---------------------------------------------------- | ------------------------------------ |
| Customer identification | [ID Verification (KYC)](/kyc/overview) | AML 5/6AMLD, MiCA, PSD2 |
| Beneficial owner verification | [Business Verification (KYB)](/kyb/overview) | AML 5/6AMLD, Company Law |
| Sanctions & PEP screening | [AML Screening](/aml/overview) | AML 5/6AMLD, OFAC, EU Sanctions |
| Ongoing monitoring | [AML Monitoring](/aml/monitoring-create) | AML 5/6AMLD |
| Liveness / biometric check | [3D Liveness Detection](/kyc/overview) | eIDAS (Level of Assurance), PSD2 SCA |
| Proof of address | [AI PoA Verification](/fraud-prevention/ai-poa) | AML CDD, Gambling regulations |
| Data retention & deletion | [Identification Deletion](/kyc/deletion) | GDPR Art. 17 |
| Fraud risk assessment | [Risk Scoring](/fraud-prevention/risk-assessment) | PSD2, Internal risk policies |
| Re-authentication | [Face Authentication](/face-authentication/overview) | PSD2 SCA, eIDAS |
***
## Regulatory Framework Guides
Data protection for processing EU customer data. Covers data minimization, retention, right to erasure, and cross-border transfers.
Anti-Money Laundering customer due diligence requirements for financial institutions.
EU electronic identification and trust services regulation.
Sector-specific requirements: fintech (MiCA, PSD2), crypto (Travel Rule), gambling.
Need a Data Processing Agreement (DPA), SOC 2 report, or security questionnaire response? Contact **[dpo@idenfy.com](mailto:dpo@idenfy.com)** or your account manager.