Snapshot 51917
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Trust We carry the compliance. Launch identity checks in one click We handle the licenses, subsidiaries, and audits so your compliance and risk team can move faster. Flip a switch and launch in any country compliantly, SOC 2 Type 1 & Type 2, ISO/IEC 27001, and the Tesoro EU government attestation included. Get a demoRead the regulator report By the numbers By the numbers 100% Real uptime over the last 12 months. Logged live at status.didit.me against the 99.99% SLO (Service Level Objective). 0 Material breaches since Didit launched. Battle-tested in production since 2023. Millions Humans verified every month on the production fleet. Certified Compliant everywhere Didit operates, SOC 2 Type 1 & Type 2, ISO/IEC 27001, iBeta Level 1 PAD, and Spain's regulator attestation. Public record Regulators say Didit is safer than in-person verification. Spain stress-tested Didit's remote Near-Field Communication (NFC) chip read plus active liveness and put it on the public record as at least as safe as checking an ID in person. No other identity provider holds this attestation. Supervised by Read the full report “Didit's NFC + active liveness verification offers security equivalent to or greater than in-person verification.” Spanish Treasury, Informe de Conclusiones DIDIT, February 2026 November 2024 – July 2025 · Sandbox financiero (Ley 7/2020), 4th cohort · supervised by Tesoro Público, Banco de España, SEPBLAC, and CNMV. Fraud engineering A dedicated fraud team. Models, monitoring, prevention. A team focused only on fraud builds, trains, and monitors the detection models behind every Didit session, deepfakes, injection attacks, forgeries, synthetic identities, money mules. New attack in the wild? New signal that week. Legitimate users never feel it. Models, built and retrained in-house. Liveness, deepfake detection, document classifiers, face match, injection-attack detection, behavioural risk, every model lives in our own training and serving pipeline. Monitoring, every session, every hour. Production traffic feeds a real-time review queue. Drift, false-positive rate, attack-pattern shifts and per-country signal quality are watched continuously; thresholds are re-tuned without a customer code change. Prevention, inline, invisible to the user. Every model integrates inline on the session. Sub-2-second p99 inference, no extra round-trip, no extra tap. The legitimate user finishes verification in the same flow; only the attacker sees a different path. Certifications Every claim has a document behind it. Ten attestations, memberships, and compliance frameworks covering security, privacy, health data, biometric anti-spoofing, authentication standards, regulatory adequacy, youth protection, and government recognition. Every card delivers a real document or a public record, not a marketing PDF. New AICPA · 2026-07-30 SOC 2 Type 2 Independent audit of our security, availability, and confidentiality controls operating effectively over the March–July 2026 observation period, issued by Atom Assurances in July 2026. Get the report AICPA · 2026-04-09 SOC 2 Type 1 Independent audit of the design of our security, availability, and confidentiality controls, issued by ATOM in April 2026. The Type 2 examination followed in July 2026. Get the memo ES144068 · Bureau Veritas ISO/IEC 27001:2022 Certifies that our information-security management covers Didit verifications end to end. Issued by Bureau Veritas, valid through June 2027. View the certificate Spain · CNMV · SEPBLAC · BdE Tesoro sandbox attestation A year-long sandbox by four Spanish financial regulators concluded Didit's remote verification is at least as safe as in-person ID checks. No other identity vendor holds this. Read the conclusion FIDO · Associate · 2026-08-13 FIDO Alliance member Didit is an Associate Member of the FIDO Alliance, the industry body behind FIDO2 and passkeys. Membership gives us a royalty-free licence to the FIDO specifications and a seat at its plenary meetings — it is not a FIDO certification. See the member listing ISO/IEC 30107-3 · NIST/NVLAP iBeta Level 1 PAD Biometric anti-spoofing test, 360 attempts across six attack categories, zero got through. Conducted at NIST-accredited NVLAP lab 200962. View the report EU 2016/679 · DPA · TOMs GDPR Article 32 Full General Data Protection Regulation (GDPR) compliance as a Data Processor. Data Processing Agreement and Technical and Organisational Measures available on request. Read the compliance posture US · 45 CFR Parts 160 & 164 · PHI HIPAA Built to handle protected health information safely. Encryption in transit and at rest, role-based access, and audit trails align with the Health Insurance Portability and Accountability Act (HIPAA) Security Rule safeguards. Request the details EBA/GL/2022/15 · MiCA EBA / MiCA compliance Independent legal opinion: Didit's remote onboarding meets the European Banking Authority Guidelines on remote customer onboarding (EBA/GL/2022/15) and is compatible with the incoming EU Anti-Money Laundering (AML) Single Rulebook and the Markets in Crypto-Assets (MiCA) regulation. Get the memo Germany · JMStV §4(2) · 2026-06-29 FSM Jugendschutz geprüft Germany's youth-protection self-regulator (FSM) certified that Didit's Age Verification System reliably establishes a closed user group under Section 4(2) JMStV, so only verified adults reach age-restricted content. Read the assessment Data protection What we store, where we store it, how long we keep it. You own the data; Didit processes it on your behalf. Under GDPR (General Data Protection Regulation) you're the Data Controller and Didit is the Data Processor. The platform ships with GDPR Article 32 controls and local data-protection rules already wired in. Encryption at rest — AES-256. Every session is encrypted at rest with 256-bit AES (Advanced Encryption Standard) keys. The keys never touch our application code, they live in AWS KMS (Key Management Service), with separate keys for sandbox and production. Encryption in transit — TLS 1.3. Every API call, webhook, and Business Console session is encrypted over TLS (Transport Layer Security) 1.3 with strict cipher rules. Older protocols can't fall back in; HSTS (HTTP Strict Transport Security) is enforced site-wide. Data residency — EU by default. Sessions are processed and stored in the European Union by default on AWS. Enterprise can enable in-country residency, subject to availability, so teams in any market run Didit compliantly. Retention — 1 month to 10 years. Pick how long Didit keeps each session, from one month to ten years, per app in the Business Console. Minimal-footprint deployments can delete the session as soon as the webhook lands. Biometric handling — Data minimization. You choose what Didit collects and how long verification data is kept. If retained biometric templates are enabled, they remain image-free, tenant-scoped, separately managed, and subject to a finite expiry. Data subject rights — Tracked deletion and erasure. Operational deletion removes session data and may leave an opted-in retained template. Privacy erasure purges both. Completion is reported only after every in-scope store confirms purge or approved beyond-use handling. FAQ Security questions, answered. The same answers we send to enterprise security teams. Anything else, security@didit.me. How secure is Didit? Zero data breaches since Didit launched in 2023. Security is built into every layer of the platform. Zero breaches, across millions of verifications and 3,000+ paying customers. Everything is encrypted, both when data is stored and when it moves between systems. Encryption keys live in Amazon Web Services (AWS), separated so a sandbox cannot read production data. Every request is checked. Every action is logged. No shared secrets across customers. Independently audited, SOC 2 Type 1 & Type 2, ISO/IEC 27001:2022, and iBeta Level 1 Presentation Attack Detection (PAD) with 0% attack-success across 360 attempts. Live public status page at status.didit.me, every incident, every post-mortem, no login required. 100% uptime over the last 6 months. If anything happens, we tell you within hours, well inside the General Data Protection Regulation (GDPR) Article 33 reporting window. Enterprise gets a named engineer on call 24/7, with a dedicated Slack and WhatsApp channel. Request the Trust Pack on this page, SOC 2 report, ISO certificate, iBeta report, Tesoro attestation, Data Processing Agreement (DPA), sub-processors list, sent back the same business day under a signed Non-Disclosure Agreement (NDA). I have lots of verifications. Will Didit support my volume? Yes. The infrastructure scales itself in real time and supports millions of verifications a day. Scales automatically. When your traffic doubles overnight, the platform expands itself. No sales call, no capacity-plan rewrite, no warning needed. Every check completes in under 2 seconds, even at peak load. The infrastructure is optimised for fast inference end to end. 100% uptime over the last 6 months. Track it live at status.didit.me, no login required. Battle-tested in production, 3,000+ paying customers across 220+ countries, in production since 2023. Built for spike events, sports-betting kick-offs, marketplace launches, age-verification rollouts. The platform handles the spike without anyone at Didit having to lift a finger. Enterprise contracts include written guarantees, a Service Level Agreement (SLA) on speed, uptime, and capacity, with billing credits if we miss. Volume tiers on the pricing page kick in automatically as you grow, no contract change, no manual renegotiation. What data does Didit store, and how much control do I have over it? You choose, per workflow. Didit does not have a fixed list of what we keep. Your compliance team configures each app in the Business Console, and the workflow only collects and stores what you tell it to. The Returned-data tab gives you a toggle for every category: Identity (ID) document images and Machine-Readable Zone (MRZ) fields Near-Field Communication (NFC) chip data Extracted identity fields (name, date of birth, document number, expiry, address) Biometric templates Raw selfie and full liveness video Device fingerprint, browser, operating system, platform Internet Protocol (IP) geolocation, Virtual Private Network (VPN) / Tor signals Document-location match coordinates Anti-Money Laundering (AML) screening hits with sanctions, Politically Exposed Person (PEP), and adverse-media match details Webhook payload, audit log, and per-session metadata The exact list of toggles depends on the modules in your workflow, check them when you set the workflow up in the Business Console under Returned-data. Who is the Data Controller and who is the Data Processor? You are the Data Controller. Didit is the Data Processor. This is the General Data Protection Regulation (GDPR) Article 28 set-up most regulated buyers expect. You decide why the data is collected, what fields are kept, how long they are retained, and who inside your team can act on them. The Data Processing Agreement (DPA) on this page is the contract that binds Didit to those instructions. Didit processes the data on your behalf, running the verifications, the screening, the biometric checks, the document classification, the webhooks, under your DPA and under our own SOC 2, ISO/IEC 27001, and General Data Protection Regulation (GDPR) Article 32 controls. We recommend you let Didit store and access the data on your behalf. Most of our customers do. Securing identity data at internet scale is a full-time job: hardened encryption, key rotation, intrusion detection, vulnerability management, certification renewals, regional residency, data-subject-rights tooling, breach notification. Didit's security and platform teams focus on it every day so your compliance and engineering teams do not have to. You retain full control through the Business Console, every retention rule, every Data Subject Access Request (DSAR), every delete is yours to trigger. If your policy requires the data to live entirely in your own environment (your cloud account, your on-premise database), we support that too, Didit runs as a processor on a fetch-and-forget basis and your team owns retention end to end. Where is data stored, and can I choose the region? European Union by default. Specific region or in-country available on Enterprise. The default deployment runs on Amazon Web Services (AWS) in EU. Data is encrypted at rest and in transit, with encryption keys held by AWS and separated per environment. European Union (default), every account. Covers the General Data Protection Regulation (GDPR) and the Schrems II / European Union, United States Data Privacy Framework. Specific region (United States East, Asia-Pacific, etc.), Enterprise contracts, when your regulator requires it. In-country residency (Brazil, India, etc.), Enterprise, subject to availability, for local laws like Brazil's Lei Geral de Proteção de Dados (LGPD) and India's Digital Personal Data Protection Act (DPDPA). When data crosses a border, it is protected by the European Commission's 2021 Standard Contractual Clauses (SCCs). The matching Transfer Impact Assessment (TIA) ships with the Trust Pack on this page. How long do you keep data, and how do I configure retention? You set the retention window. From 1 month to 10 years, per app. Enforcement is automatic. In the Business Console you set: A global retention window, anywhere from 1 month (when you want Didit to keep nothing after your webhook fires) to 10 years (the Anti-Money Laundering Directive 6 (AMLD6) ceiling). Per-data-category retention, biometric templates can outlive raw images; screening hits can outlive identity data; document-location match can be dropped entirely. Automatic enforcement, every night, the platform deletes anything past its retention window across every copy. Every delete is recorded in the audit log. If you want Didit to keep nothing after the verdict, call POST /v3/sessions/:session_id/delete/ from your webhook handler and the session is gone the moment your system records its own copy of the result, Didit never holds the data past the call. Full reference at docs.didit.me/sessions-api/delete-session. How do you handle Data Subject Access Requests (DSARs), deletion, and portability? The instruction determines the outcome. Access and portability, retrieve the session payload at GET /v3/sessions/:session_id/decision/. Reference: docs.didit.me/sessions-api/retrieve-session. Operational session deletion, use POST /v3/sessions/:session_id/delete/ to remove the session and session-owned data. An opted-in, finite retained biometric template may remain, and the response states that outcome. Privacy erasure, send the privacy-erasure instruction so the session and every attributable retained template are purged. An accepted request remains deletion requested until every in-scope store confirms completed purge or approved beyond-use handling. Contact the Customer that requested the verification for a data-subject rights request. Which certifications and attestations do you hold? Six external attestations on file. All packaged in the Trust Pack. SOC 2 Type 1, Security, Availability, and Confidentiality, issued by ATOM in April 2026 under the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria. SOC 2 Type 2, operating effectiveness of the same controls over the March 9 – July 1, 2026 observation period, issued by Atom Assurances in July 2026. ISO/IEC 27001:2022, Information Security Management System, certified by Bureau Veritas (certificate ES144068, valid through 2027-06-03). iBeta Level 1 Presentation Attack Detection (PAD), independent biometric anti-spoofing test, conducted under ISO/IEC 30107-3 at a National Institute of Standards and Technology (NIST)-accredited lab. 0 successful attacks across 360 attempts. GDPR Article 32, Data Processing Agreement (DPA), sub-processor list, and Technical and Organisational Measures (TOMs), all public. European Banking Authority (EBA) / Markets in Crypto-Assets (MiCA) memo, independent legal opinion that Didit satisfies the EBA Guidelines on remote customer onboarding (EBA/GL/2022/15) and the MiCA regulation. Request the Trust Pack on this page and we send every report, certificate, and memo back the same business day under a signed Non-Disclosure Agreement (NDA). What does the Spanish regulator attestation actually mean for me? Mutual recognition across the European Union (EU), and a regulator-defensible audit trail. Spain's Tesoro Público, Banco de España, SEPBLAC, and CNMV ran a year-long financial sandbox (November 2024 – July 2025) on Didit's Near-Field Communication (NFC) chip read plus active liveness onboarding flow. The official conclusions report, published on tesoro.es, finds Didit's remote verification meets or exceeds the security level of in-person identification under the Anti-Money Laundering Directive (AMLD). For your compliance team this means: AMLD6 mutual recognition, the attestation is portable across every other EU member state without re-certification. Defensible audit trail, when your local Financial Intelligence Unit (FIU) reviews your onboarding, you point at the same report your EU peer regulators have signed off on. Didit is the only identity-verification vendor with this attestation on the public record. Can I ask Didit to obtain a specific license or certification? Yes, and we are probably already working on it. Didit is actively pursuing 10+ certifications, licenses, and regulator approvals across markets and verticals at any given time: payment authorisations, crypto and Markets in Crypto-Assets (MiCA) registrations, Anti-Money Laundering (AML) supervisor approvals, eIDAS 2.0 Qualified Trust Service Provider (QTSP) status, regional Financial Intelligence Unit (FIU) reporting, and vertical-specific authorisations (iGaming, healthcare, banking). If there is a license or certification your compliance team needs Didit to hold, email `security@didit.me`. Odds are it is already in our queue, and if it is not, your request bumps it up the list. We come back with: Where the certification sits in our roadmap. The expected timeline. The scope (full coverage, a specific region, a specific module). Infrastructure for identity and fraud. One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes. Start freeTalk to us Ask an AI to summarise this page