Security & Compliance
Protecting digital identity with enterprise-grade security and comprehensive compliance.
Security and compliance form the foundation of everything we build at Vidos. As enterprises trust us with their identity verification infrastructure, we maintain rigorous standards for operational excellence, data protection, and regulatory compliance.
This page sets out how we do that in practice: the controls we run, how we handle and delete data, and what we commit to in our contracts.
Data Protection & Privacy
GDPR Compliance
We process personal data under the UK GDPR and the EU GDPR, acting as processor for our customers under a Data Processing Agreement.
- Data Minimization: We only process data necessary for verification purposes
- Purpose Limitation: Data is used solely for its intended identity verification purpose
- Privacy by Design: Privacy protection is built into our architecture from the ground up
- User Rights: Support for data portability, erasure, and access requests
Data Residency
- Infrastructure hosted on AWS (EU Ireland region)
- Production runs across multiple availability zones within the region
- International data transfers protected by appropriate safeguards (SCCs/IDTA)
Retention and Deletion
Each category of data has a fixed retention period, after which it is deleted.
- DID resolution: processed transiently and never stored
- Verification, validation and authorisation records: deleted 30 days after processing
- Database backups: kept for 30 days
- Application and security logs: kept for 12 months to support investigations
- End of contract: customer personal data is deleted or returned, at the customer’s choice
Encryption Standards
- At rest: all customer data, including backups, is encrypted with AES-256
- In transit: TLS 1.2 or higher on every web page and API that handles customer data
- Secrets: held in AWS Secrets Manager and an encrypted parameter store, with access granted per service and never written into code
- Passwords: salted and hashed, never stored in plain text
Infrastructure Security
Architecture
- Network Isolation: production resources sit in dedicated AWS VPCs, with security groups and network ACLs controlling traffic between segments
- Hardened configuration: unused ports and services are disabled, and firewall rules are reviewed every quarter
- Tenant separation: every customer account has its own identifier, and all resources and data access are scoped to it
- API Security: authentication and rate limiting on every endpoint, with limits set per account to protect the service for all customers
Access Controls
- Principle of Least Privilege: access is granted by role, only for the duties that need it
- Multi-Factor Authentication (MFA): required for all access to the production environment
- Access reviews: every quarter, and access is revoked as soon as someone leaves or changes role
- Managed devices: production systems and customer data can only be reached from enrolled, company-managed devices
- Customer data: our team has no access to unencrypted customer data
Monitoring and Logging
- Every API call and administrative action in production is recorded with AWS CloudTrail
- AWS GuardDuty and CloudWatch watch for suspicious activity and alert the team
- Logs are protected against modification and deletion, with access restricted to authorised staff
Your Account
- Two-factor authentication for dashboard users, with any standard authenticator app
- Progressive lockout after repeated failed sign-in attempts
- A strong password policy for every user
- Roles and permissions that you manage for your own team
Security Engineering
Secure Development
- A secure code review before every release
- Automated unit and integration tests run before deployment
- Production changes follow a documented change control process, with approval and an audit trail
- Development and test environments are separated from production and never use customer data
Vulnerability Management
- Dependency, container image and malware scans on every change, and at least weekly
- Vulnerability scans of internet-facing services every quarter and after significant changes
- Critical and high-risk patches applied within 14 days of release
Incident Response
- A documented incident response plan with defined roles and escalation
- Customers notified within 24 hours of a personal data breach or a security incident affecting their service
- A public status page with live service status, uptime history and past incidents
- Incident reports and root cause analysis made available within 48 hours of resolution
Availability & Continuity
Service Level Agreements
Monthly uptime commitments are set by support level and written into our Terms of Service, with service credits when we fall short.
- Basic: 99.5% monthly uptime
- Business: 99.9% monthly uptime
- Advanced: 99.95% monthly uptime
- Maintenance: scheduled work is announced at least 48 hours in advance
Business Continuity
- Recovery Time Objective: 4 hours
- Recovery Point Objective: 1 hour
- Data Backup: automated and encrypted, in geographically separate locations
- Testing: failover and data recovery exercises every year
Compliance Framework
eIDAS 2.0 Ready
- Support for European Digital Identity Wallet requirements
- Cross-border interoperability standards
Industry Standards
- W3C Standards: Full compliance with Verifiable Credentials and DID specifications
- OpenID Standards: Support for OpenID4VC and OpenID4VP protocols
- ISO/IEC 18013-5 & 18013-7: Compatible with mobile driving license standards
Governance & Transparency
Policies and Risk
- Information security policies reviewed and approved every year
- Formal risk assessments every year and whenever operations change significantly
- Annual internal audits of our security and quality processes
- Security assessments of every supplier with access to sensitive systems or data
People
- Background checks before anyone joins or is given access to sensitive systems
- Confidentiality obligations for every member of staff and contractor
- Security awareness training for all staff every year
Transparency
- Privacy Policy: Clear, accessible privacy policy
- Data Processing Agreements: a DPA for every customer, covering UK and EU data protection law
- Subprocessors: a published list, with at least 30 days’ notice of changes and the right to object
- Breach Notification: within 24 hours of becoming aware of a breach affecting customer personal data
Build on a Foundation of Trust
From financial services to government applications, Vidos provides the security assurance and regulatory alignment your organization requires.
To discuss your specific requirements, contact our security team.