We're transparent about where we stand. As we scale, we pursue real audits and accreditation — not shortcuts.
Third-Party Audits & Certifications
Independent verification of our security controls, processes, and infrastructure by qualified third-party auditors.
SOC 2 Type II
- Independent audit of security, availability, confidentiality, processing integrity, and privacy controls. Covers the deepidv verification platform, APIs, and supporting infrastructure.
ISO/IEC 27001:2022
- Certified Information Security Management System (ISMS) covering all deepidv operations, from product development through service delivery and customer support.
GDPR Compliant
- Full compliance with the General Data Protection Regulation (EU) 2016/679. Data Processing Agreements available for all business clients. Standard Contractual Clauses executed for international transfers.
In Progress
Certifications and standards we are actively pursuing.
iBeta Level 1 & 2
In ProgressIndependent biometric testing by iBeta Quality Assurance for ISO 30107-3 Presentation Attack Detection (PAD). Validates liveness detection against printed photos, screen replays, and 3D masks.
HIPAA
In ProgressHealth Insurance Portability and Accountability Act compliance for processing protected health information (PHI) in healthcare identity verification workflows.
FIDO Alliance
In ProgressFIDO2/WebAuthn certification for passwordless authentication standards. Enables phishing-resistant biometric authentication across deepidv verification flows.
ISO/IEC 27018
In ProgressCode of practice for protection of personally identifiable information (PII) in public clouds. Extends ISO 27001 with cloud-specific privacy controls.
ISO 31000:2018
In ProgressInternational standard for risk management framework and principles. Guides deepidv's approach to identifying, assessing, and mitigating operational and security risks.
Security Practices
Our security program is aligned with ISO 27001, SOC 2, NIST CSF 2.0, and the OWASP ASVS. Overseen by a dedicated CISO reporting directly to the CEO.
Encryption
- AES-256 encryption for all data at rest
- TLS 1.3 for all data in transit with perfect forward secrecy
- FaceX/TripleLock three-party nested AES-256-GCM biometric encryption
- HSM-managed key rotation on defined schedule
Data Isolation
- Per-client data isolation with separate encryption keys
- AWS Lambda, DynamoDB, SQS with strict IAM policies
- Network segmentation with isolated prod/staging/dev environments
- No commingling of verification data across clients
Access Controls
- Role-based access control (RBAC) with principle of least privilege
- MFA mandatory for all production, admin, and code access
- Just-in-time (JIT) provisioning for privileged access
- Quarterly access reviews by CISO with immediate revocation
Monitoring & Detection
- 24/7 SIEM with ML-based anomaly detection
- Endpoint detection and response (EDR) on all managed devices
- Cloud security posture management (CSPM) for AWS
- Real-time alerting with automated incident playbooks
Application Security
- Secure SDLC with SAST, DAST, SCA integrated in CI/CD
- Mandatory peer code review for all changes
- Regular third-party penetration testing
- Vulnerability management with severity-based SLAs
Incident Response
- Documented IRP with 72-hour GDPR breach notification
- Forensic analysis and evidence preservation capabilities
- Real-time status at status.deepidv.com via incident.io
- Post-incident review with lessons-learned process
Our Privacy Promise
At Deep Identity Inc., privacy is not a compliance checkbox — it is the architecture of everything we build. Our platform is designed so that your data belongs to you.
We enforce this promise through advanced cryptography, strict data minimization, and complete transparency in our policies and practices.
Read our full Privacy CenterNo Data Sales
We do not sell, trade, or rent your personal data. Ever. The only exception is voluntary participation in clearly identified opt-in research programs.
Data Minimization
We collect only what is necessary for the specific service requested. Biometric data for liveness is deleted within 24 hours of successful verification.
Transparency
Our Privacy Center contains 16 policies covering every aspect of data handling. No hidden practices, no fine print surprises.
Data Sovereignty
FaceX/TripleLock ensures no single party — including deepidv — can access raw biometric data without the cooperation of all three independent key holders.
Regulatory Compliance
We maintain compliance across multiple jurisdictions and regulatory frameworks worldwide.
Frequently asked questions
Common questions about deepidv's security, privacy, and compliance practices.
Still have questions?
Our team is ready to help you get started.
Ready to get started?
See how deepidv protects your users and your business with AI-native identity verification.