ApidentitybyAdesio
DemonstrationDeclarant identity in this deployment is SIMULATED. No qualified trust service is contracted, nothing here has been identified by anyone, and any certificate issued in this mode is a demonstration rather than an attestation.

Trust centre

What we hold, what we do not, and what enforces the difference. Every control below names the migration, grant or test that makes it true — because a trust centre kept by hand drifts, and a drifted one is worse than none.

Quick answers

Does Apidentity hold SOC 2 or ISO 27001? Intended, not started for SOC 2 Type II, Not held for ISO 27001 — see "Where we stand on frameworks" below for what each status word means and what would change it.

Is Apidentity GDPR compliant? In place — EU hosting, minimal retention, a documented lawful basis per processing activity, and no special-category data processed at all.

Does a third party hold your data? 1 subprocessor(s) do — see the subprocessor page for which, and for what.

Is identity checked with biometrics? No. Declarant identity is established by a qualified trust service under eIDAS, not a biometric check of our own.

The short version

1 subprocessor(s) are inside the audit boundary. Screening runs against lists we download and match in process, so the name of the company you are checking is never sent anywhere. Declarant identity is established by a qualified trust service under eIDAS, so no biometric data is processed here at all.

Hosted in the European Union. Evidence is immutable and the audit log is hash-chained, so a removed or altered record is detectable rather than merely discouraged.

Where we stand on frameworks

SOC 2 Type II Intended, not started Scoped to Security, Confidentiality, Availability and Processing Integrity. The last of those is unusual and deliberate: "outputs are complete, accurate, timely and authorised" is literally what a verification engine sells, and most vendors leave it out. No audit period has begun and no report exists.
ISO 27001 Not held Not held, not in progress. No audit has been commissioned and no certificate exists. A previous generation of this product stated otherwise on a public page, and that was wrong; it is being corrected rather than quietly removed. If it changes, the status word above changes with it and the evidence line names the certificate body and the scope.
GDPR In place An obligation rather than a certificate, so "held" here means the posture is implemented: EU hosting, minimal retention, a documented lawful basis per processing activity, and no special-category data processed at all.
Records of processing and the DPA are available on request
eIDAS Intended, not started Not a certification we hold — a standard we consume. Declarant identity is established by a qualified trust service provider, supervised under eIDAS by ANSSI in France, rather than by a biometric check of our own. No provider is contracted yet; the shortlist is the EU Trusted List, which is public and checkable.
Regulation (EU) 910/2014, as amended — eIDAS Dashboard, eidas.ec.europa.eu/efda
EUCC Does not cover us The Common Criteria scheme certifies ICT PRODUCTS — smart cards, hardware with security modules, and discrete software products with a defined target of evaluation. Apidentity is an operated service, so there is nothing here to evaluate under it. Listed because the question is reasonable and the answer should not be a blank: ANSSI issued Europe's first EUCC certificates in March 2025, to STMicroelectronics and Thales DIS, in exactly those product categories.
Implementing Regulation (EU) 2024/482, under the Cybersecurity Act
EUCS (cloud) Intended, not started The scheme that WOULD cover a service like this, and it is still under development. Its high assurance level is being built on SecNumCloud, which makes the hosting decision a position on EUCS rather than only on sovereignty. Where that stands, precisely, because a status word on its own would be doing work it has not earned: the service runs on infrastructure operated by OVH GmbH, which is named on the subprocessor page, and is not qualified SecNumCloud today. SecNumCloud is the destination rather than the starting point. Checked in August 2026, the smallest qualified pack at the provider we would use is about €45k a year before support, and the offer actually sized for a service like this is itself still in qualification. So this is targeted and dated rather than claimed.
Cybersecurity Act (EU) 2019/881 — scheme in preparation
EUDI Wallet scheme Does not cover us Under development, and it certifies wallets rather than the services that read them. It matters to us the other way round: the assurance our declarant check rests on will terminate in an artefact certified under an EU scheme rather than in a vendor's own claim about itself.
Cybersecurity Act (EU) 2019/881 — scheme in preparation
CSPN Not held ANSSI's first-level certification, which EUCC does not replace. Not pursued: like EUCC it evaluates a product, and the thing worth certifying here is the operated service.
ANSSI national scheme
On the European schemes

The European schemes above are published under the Cybersecurity Act (EU) 2019/881 and are voluntary. They define three assurance levels — basic, substantial and high — and at the high level the certificate is issued by the national authority itself, which in France is ANSSI. None of them is a requirement we are failing to meet; two of them do not cover what we are, and the one that would is not finished.

We run ourselves through it

Adesio holds an Apidentity certificate, produced by the same engine, against the same registry and the same lists. It does not grade band A. The identity axis is partial, the ownership chain above us is unwalked, and the engine says so rather than making an exception for the company that wrote it.

Check any certificate, including ours.