> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & compliance

> Didit security and compliance posture: SOC 2 Type 2, ISO 27001, GDPR, iBeta Level 1, FSM youth protection, EU AI Act ready, and validated by Spain's Treasury and SEPBLAC.

export const StatGrid = ({children}) => <div className="didit-stat-grid">
    {children}
  </div>;

export const StatCard = ({value, label}) => <div className="didit-stat-card">
    <span className="didit-stat-value">{value}</span>
    <span className="didit-stat-label">{label}</span>
  </div>;

export const SectionHeader = ({label, title, description, align = "left"}) => <div className="didit-section-header" style={{
  textAlign: align,
  alignItems: align === "center" ? "center" : "flex-start"
}}>
    {label && <p className="didit-section-label">{label}</p>}
    <h2 className="didit-section-title">{title}</h2>
    {description && <p className="didit-section-desc">{description}</p>}
  </div>;

export const FeatureGrid = ({cols = 3, children}) => <div className="didit-feature-grid" style={{
  "--grid-cols": cols
}}>
    {children}
  </div>;

export const FeatureCard = ({icon, title, description, href}) => {
  const inner = <div className="didit-feature-card">
      {icon && <div className="didit-feature-card-icon">
          <Icon icon={icon} size={20} />
        </div>}
      <div className="didit-feature-card-content">
        <h3 className="didit-feature-card-title">{title}</h3>
        {description && <p className="didit-feature-card-desc">{description}</p>}
      </div>
      {href && <div className="didit-feature-card-arrow">
          <Icon icon="arrow-right" size={14} />
        </div>}
    </div>;
  if (href) {
    return <a href={href} style={{
      textDecoration: "none",
      color: "inherit",
      display: "block",
      border: "none",
      boxShadow: "none"
    }}>{inner}</a>;
  }
  return inner;
};

Didit is built from the ground up with security as a first-class principle. Every layer of the platform — from infrastructure to AI models — is designed to meet the highest international standards for information security, data privacy, and biometric accuracy.

<StatGrid>
  <StatCard value="SOC 2" label="Type 2 Certified" />

  <StatCard value="ISO" label="27001 Certified" />

  <StatCard value="GDPR" label="Compliant" />

  <StatCard value="iBeta" label="Level 1 Certified" />

  <StatCard value="FSM" label="Youth Protection" />

  <StatCard value="AI Act" label="Ready" />
</StatGrid>

***

<SectionHeader label="Government-validated" title={<>More secure than <span>in-person</span></>} description="Validated by the Spanish Treasury, SEPBLAC, and CNMV — the first and only provider to receive this validation." />

<Info>
  **"Didit's NFC + active liveness verification offers security equivalent to or greater than in-person verification."**
  — Official report, Spanish Treasury ([tesoro.es](https://www.tesoro.es/documents/d/tesoro/informe-conclusiones-didit-pdf))
</Info>

After a year-long test by Spanish financial regulators — the Spanish Treasury (Tesoro Público), SEPBLAC (the financial intelligence unit), Banco de España, and CNMV (the securities and markets commission) — Didit was recognized as the only provider whose NFC + active liveness flow meets or exceeds the security level of in-person identity verification.

<FeatureGrid cols={2}>
  <FeatureCard icon="award" title="Only provider with this validation" description="First and only vendor to pass the year-long financial-regulator test in Spain. Independent, adversarial, and repeatable." />

  <FeatureCard icon="chart-network" title="200+ signals per verification" description="Biometric, document, behavioral, and database signals cross-checked in real time on every session." />

  <FeatureCard icon="database" title="Connected to government data sources" description="Integrated one-by-one with authoritative government databases worldwide to confirm identity against source-of-truth records." />

  <FeatureCard icon="file-certificate" title="Global licenses & compliance" description="SOC 2 Type 2 certified, ISO 27001, ISO 27017, ISO 27018, GDPR, iBeta Level 1 (ISO 30107-3), and FSM youth-protection certified. Licensed and compliant in every country we operate." />
</FeatureGrid>

***

<SectionHeader label="Certifications" title={<>Certified for <span>enterprise trust</span></>} description="Our platform meets the highest international standards for information security, data privacy, and biometric accuracy." />

<CardGroup cols={2}>
  <Card title="SOC 2 Type 2" icon="shield-halved">
    **Service Organization Controls — Type 2.** An independent audit against the AICPA Trust Services Criteria confirmed Didit's security, availability, and confidentiality controls **operated effectively over the March 9 – July 1, 2026 observation period**. Issued July 2026 (Type 1 issued April 2026). Report available to enterprise customers under NDA.
  </Card>

  <Card title="FSM Jugendschutz geprüft" icon="child-reaching">
    **German youth-protection certification.** Germany's youth-protection self-regulator (FSM) certified that Didit's Age Verification System reliably establishes a closed user group under **Section 4(2) JMStV**, so only verified adults reach age-restricted content.
  </Card>

  <Card title="ISO/IEC 27001" icon="shield-check">
    **Information security management.** Didit maintains a certified Information Security Management System (ISMS) covering the design, development, and operation of the identity verification platform. Certificate excerpts available on request.
  </Card>

  <Card title="ISO/IEC 27017" icon="cloud">
    **Cloud security controls.** Extended cloud-specific security controls that complement our ISO 27001 certification, ensuring robust protection for cloud-based verification services.
  </Card>

  <Card title="ISO/IEC 27018" icon="user-shield">
    **Cloud privacy protection.** Dedicated controls for protecting personally identifiable information (PII) in cloud environments, going beyond general data protection requirements.
  </Card>

  <Card title="GDPR Compliant" icon="scale-balanced">
    **Full EU data protection compliance.** Didit is fully compliant with the General Data Protection Regulation. We act as a data processor — you remain the data controller. DPA and TOMs available on request.
  </Card>

  <Card title="iBeta Level 1 — ISO 30107-3" icon="face-smile">
    **Biometric presentation attack detection.** Our liveness detection technology is iBeta Level 1 certified under the ISO 30107-3 standard, ensuring reliable detection of spoofing attempts including printed photos, screen replays, and 3D masks.
  </Card>

  <Card title="EU AI Act Ready" icon="robot">
    **Responsible AI compliance.** Didit's AI-powered verification systems are designed in alignment with the EU AI Act requirements for high-risk AI systems, including transparency, human oversight mechanisms, data governance, and bias monitoring.
  </Card>

  <Card title="EBA / MiCA compatibility" icon="scale-balanced">
    **Remote onboarding, regulator-grade.** An independent legal opinion confirms Didit's remote onboarding meets the EBA Remote Customer Onboarding Guidelines (EBA/GL/2022/15) and is compatible with the EU AML Single Rulebook and MiCA.
  </Card>
</CardGroup>

<Card title="See every certification" icon="badge-check" href="/getting-started/certifications">
  The complete, always-current list — SOC 2 Type 2 and Type 1, ISO 27001/27017/27018, iBeta Level 1, FSM, the Spanish regulator attestation, EBA/MiCA, and GDPR — with dates and how to get each report. We add more all the time; if you need a specific certification, [book a demo](https://didit.me/get-a-demo/) and tell us.
</Card>

***

<SectionHeader label="Security Infrastructure" title={<>How we protect <span>your data</span></>} />

<FeatureGrid cols={2}>
  <FeatureCard icon="lock" title="End-to-end encryption" description="All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Industry-standard cryptographic protocols protect sensitive information at every stage." />

  <FeatureCard icon="users" title="Role-based access control" description="Granular permissions and role-based access ensure only authorized personnel can access verification data and system configurations." />

  <FeatureCard icon="clipboard-list" title="Complete audit logs" description="Every action is logged with timestamps, user IDs, and IP addresses. Audit logs are retained for 365 days and can be exported for compliance reviews." />

  <FeatureCard icon="eye" title="24/7 security monitoring" description="Continuous monitoring and automated threat detection across our entire infrastructure with real-time alerts for suspicious activity." />

  <FeatureCard icon="server" title="EU-based infrastructure" description="Data is processed and stored in the EU on AWS servers by default. Enterprise customers can enable in-country processing with local data residency options." />

  <FeatureCard icon="clock" title="Configurable data retention" description="Set retention policies from 1 month to 10 years, or delete sessions on demand via API. Process-and-purge patterns supported for minimal data footprint. Any biometric template you choose to retain after a session deletion carries its own finite expiry." />
</FeatureGrid>

***

<SectionHeader label="Fraud signals" title={<>200+ signals, <span>real-time fraud loop</span></>} description="Fully integrated fraud loop — detect, analyze, and fix in real time. Every verification is scored against 200+ signals across biometric, document, behavioral, and database sources." />

| Signal type | Capability |
| - | - |
| **Deepfakes** | +20 proprietary AI models, built in-house for the generative AI era. [Liveness →](/core-technology/liveness/overview) |
| **Injection attacks** | Camera stream tampering prevention — catches replay and video injection. [Liveness →](/core-technology/liveness/overview) |
| **Document forgery** | Hologram, reprint, screenshot, and digital alteration detection. [ID Verification →](/core-technology/id-verification/overview) |
| **Synthetic IDs** | Cross-reference against authoritative government databases worldwide. [Database Validation →](/core-technology/database-validation/overview) |
| **Behavioral signals** | Device & IP Analysis, device fingerprinting, and replay detection. [Device & IP Analysis →](/core-technology/ip-analysis/overview) |
| **Face Search 1:N** | Duplicate and multi-account detection across all verified users. [Face Search →](/core-technology/face-search/overview) |

<Tip>
  Our expert fraud team responds to new attack vectors within hours, not quarters. Models and rules are updated continuously as the threat landscape shifts.
</Tip>

***

<SectionHeader label="AI Act Compliance" title={<>Responsible AI — <span>by design</span></>} description="As an AI-native identity platform, Didit takes the EU AI Act seriously. Our systems are built to meet the requirements for high-risk AI applications." />

Identity verification using biometrics is classified as **high-risk** under the EU AI Act. Didit proactively addresses these requirements:

| Requirement | How Didit complies |
| - | - |
| **Risk management** | Continuous risk assessment across all AI models with documented mitigation strategies. |
| **Data governance** | Training data is curated for quality, relevance, and representativeness. Bias testing across demographics. |
| **Transparency** | Clear documentation of AI capabilities and limitations. Users are informed when AI processes their data. |
| **Human oversight** | Manual review workflows allow human operators to override AI decisions at any point. |
| **Accuracy & robustness** | iBeta-certified liveness detection. Regular model evaluation against adversarial attacks (deepfakes, injection, replay). |
| **Record-keeping** | Comprehensive audit logs and session records maintained for regulatory review. |
| **Non-discrimination** | Bias monitoring and testing across age, gender, ethnicity, and document types to ensure equitable treatment. |

<Info>
  Didit continuously updates its compliance posture as the EU AI Act implementing measures are finalized. Contact your Didit representative for the latest AI Act readiness documentation.
</Info>

***

<SectionHeader label="Data Protection" title={<>Your data protection <span>partner</span></>} />

Didit acts as a **data processor** — you remain the **data controller**. The platform is designed to support GDPR and local data-protection regimes out of the box.

| Aspect | Detail |
| - | - |
| **Processor role** | Didit processes personal data strictly on your behalf and under your instructions. |
| **Processing region** | EU by default (AWS). Enterprise customers can enable in-country processing. |
| **Data minimization** | Process-and-purge patterns let you retain only the fields your business requires. |
| **Data portability** | Export session data via the Console or API at any time. |
| **Right to erasure** | Delete individual sessions on demand via the Console or the [Delete Session](/sessions-api/delete-session) API. Send `deletion_instruction: "privacy_erasure"` to also purge any retained biometric template for that person. |
| **Biometric templates** | Face embeddings are deleted with the session by default. An application can opt in to retain an image-free biometric template for duplicate detection; it remains biometric data, has a finite expiry, and is purged on User deletion, privacy erasure, expiry, or explicit purge. See [Biometric templates](/management-api/biometric-templates/overview). |
| **Retention controls** | Configure retention from 1 month to 10 years in **Console → App Settings → Data**. |

## Customer responsibilities in verification flows

When you use Didit in your own onboarding, authentication, or verification experience, you remain responsible for the **controller-side disclosures and legal basis** for that flow.

| Requirement | What you need to do |
| - | - |
| **Tell the user who is involved** | Make clear that your company is requesting the verification and that Didit is the verification provider / processor powering the flow. |
| **Show your privacy notice** | Link to your own privacy notice or equivalent disclosure before the user starts verification. |
| **Link Didit's legal documents** | Link to Didit's [Verification Privacy Notice](https://didit.me/terms/verification-privacy-notice), [End User Terms for Identity Verification](https://didit.me/terms/identity-verification), and any other Didit policy your legal team requires. |
| **Collect explicit consent where required** | If your flow captures documents, selfies, liveness video, or biometrics, use an unchecked checkbox or another affirmative control wherever applicable law requires explicit consent. |
| **Handle white-label and custom UI correctly** | If you use a custom domain, white-label flow, or API-driven UI, you must render these disclosures in your own product because the branding alone does not disclose Didit's role. |
| **Keep your own records** | If your legal team requires proof of notice or consent, store the text version, timestamp, and related metadata in your own systems. |

<Warning>
  Didit provides the verification infrastructure, but it does not decide whether your specific user journey satisfies the consent, disclosure, or biometric-law requirements that apply to your business. Review your implementation with legal counsel before going live.
</Warning>

<Note>
  Need a DPA, TOMs, sub-processor list, or other compliance attestations? Contact your Didit representative or email [hello@didit.me](mailto:hello@didit.me).
</Note>

***

<SectionHeader label="Operational Security" title={<>Continuous <span>protection</span></>} />

<FeatureGrid cols={2}>
  <FeatureCard icon="bug" title="Penetration testing" description="Periodic third-party penetration tests with tracked remediation. Reports available to enterprise customers under NDA." />

  <FeatureCard icon="lock" title="No known breaches" description="No security breaches reported to date. Incident response procedures tested and documented." />

  <FeatureCard icon="user-shield" title="Internal security team" description="Dedicated cybersecurity team with least-privilege access and strict environment separation across all systems." />

  <FeatureCard icon="key" title="API key security" description="Separate Sandbox and Live API keys. Keys can be rotated at any time via the Business Console." />
</FeatureGrid>

***

## Security FAQ

<AccordionGroup>
  <Accordion title="What certifications does Didit hold?">
    Didit is **SOC 2 Type 2 certified** (July 2026, covering the March 9 – July 1, 2026 observation period; Type 1 issued April 2026), ISO 27001 certified for information security management, ISO 27017 and ISO 27018 certified for cloud security and privacy, fully GDPR compliant, iBeta Level 1 certified (ISO 30107-3) for biometric presentation attack detection, and **FSM Jugendschutz geprüft** in Germany for age verification under Section 4(2) JMStV. Didit is also the only provider attested by Spanish financial regulators (Tesoro, Banco de España, SEPBLAC, CNMV) as at least as safe as in-person verification, and holds an independent legal opinion confirming EBA/MiCA compatibility. See the complete list on the [Certifications page](/getting-started/certifications). We add more all the time — if you need a specific certification, [book a demo](https://didit.me/get-a-demo/) and tell us.
  </Accordion>

  <Accordion title="Is my data encrypted?">
    Yes. All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We use industry-standard cryptographic protocols across our entire infrastructure.
  </Accordion>

  <Accordion title="Where is data stored and processed?">
    By default, all data is processed and stored in the EU on AWS infrastructure. Enterprise customers can request in-country processing with local data residency options, subject to availability.
  </Accordion>

  <Accordion title="How do I configure data retention?">
    Navigate to **Business Console → App Settings → Data** to set your retention window (1 month to 10 years). You can also delete sessions on demand via the Console or [Delete Session API](/sessions-api/delete-session). See the [Data Retention](/console/data-retention) page for details.
  </Accordion>

  <Accordion title="Can I delete verification data?">
    Yes. Delete individual sessions through the Console or programmatically via the [Delete Session API](/sessions-api/delete-session). For maximum data minimization, use the process-and-purge pattern to delete each session as soon as you have received its webhook results.
  </Accordion>

  <Accordion title="Does deleting a session delete biometric data?">
    By default, yes: the face image, liveness video, and the face embedding used for duplicate detection are deleted with the session. If your application has opted in to [biometric-template retention](/console/data-retention#biometric-template-retention), Didit keeps one image-free face biometric template anchored to the User after an operational session deletion. That template remains biometric data, is used only for your tenant-scoped duplicate detection, has a finite expiry, and is purged on User deletion, a privacy-erasure request, expiry, or an explicit purge through the [Biometric Templates API](/management-api/biometric-templates/overview). Face blocklist entries you manage are separate and stay until you remove them.
  </Accordion>

  <Accordion title="How do you handle security incidents?">
    We maintain a documented incident response plan with defined severity levels, escalation procedures, and communication protocols. Any material incidents are reported to affected customers within the timeframes required by GDPR and applicable regulations.
  </Accordion>

  <Accordion title="Is Didit compliant with the EU AI Act?">
    Didit proactively aligns with the EU AI Act requirements for high-risk AI systems, including risk management, data governance, transparency, human oversight, accuracy testing, and non-discrimination. We continuously update our compliance posture as implementing measures are finalized.
  </Accordion>

  <Accordion title="Can I get security documentation?">
    Yes. We provide DPAs, TOMs, sub-processor lists, penetration test summaries (under NDA), and ISO certificate excerpts. Contact your Didit representative or email [hello@didit.me](mailto:hello@didit.me).
  </Accordion>

  <Accordion title="How are audit logs handled?">
    Every API call and Console action is recorded with timestamps, user IDs, and IP addresses. Audit logs are retained for 365 days and can be exported at any time. See the [Audit Logs](/console/audit-logs) page for details.
  </Accordion>
</AccordionGroup>

***

## Related resources

<CardGroup cols={2}>
  <Card title="Certifications & attestations" icon="badge-check" href="/getting-started/certifications">
    Every credential Didit holds, with dates and how to get each report.
  </Card>

  <Card title="AMLR compliance guide" icon="scale-balanced" href="/getting-started/amlr-compliance">
    Map the EU AML Regulation to Didit workflows, API endpoints and webhooks.
  </Card>

  <Card title="Data Retention" icon="clock" href="/console/data-retention">
    Configure retention policies and implement privacy-first patterns.
  </Card>

  <Card title="Audit Logs" icon="clipboard-list" href="/console/audit-logs">
    Track every action with complete audit trails.
  </Card>

  <Card title="Webhooks" icon="webhook" href="/integration/webhooks">
    Receive real-time notifications for verification events.
  </Card>

  <Card title="API Authentication" icon="key" href="/getting-started/api-authentication">
    Secure API key management and authentication.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.