Security
Security is our foundation
RoxVerify is built security-first. Certified, audited, and operated with zero breaches since launch. Our infrastructure is designed so that a compromise of any single component cannot expose customer data.
Certifications
Independent certification
RoxVerify undergoes continuous third-party audits and maintains the certifications required by the world's most regulated industries.
🏅
SOC 2 Type I
Independently audited against AICPA Trust Service Criteria covering security, availability, processing integrity, confidentiality, and privacy. Audit report available under NDA.
🏅
ISO/IEC 27001
Certified information security management system covering all aspects of how we collect, process, store, and transmit identity data across our global infrastructure.
🏅
iBeta Level 1 PAD
Our passive liveness engine is independently certified by iBeta Quality Assurance to NIST/NIAP Presentation Attack Detection Level 1 — the highest liveness certification standard.
✅
GDPR Aligned
Data processing agreements, lawful basis documentation, data subject rights workflows, and DPA-ready processing records available for all EU and EEA customers.
✅
eIDAS 2.0
Verification flows structured to meet eIDAS 2.0 assurance levels (Substantial and High). NFC ePassport flow meets High assurance requirements for regulated EU services.
✅
AMLD6 / MiCA / DORA
Compliance frameworks aligned to the EU's 6th Anti-Money Laundering Directive, Markets in Crypto-Assets Regulation, and Digital Operational Resilience Act.
Infrastructure
Infrastructure security
Zero breaches since platform launch
99.99% SLA — 100% uptime over the last 12 months
End-to-end encryption in transit (TLS 1.3) and at rest (AES-256)
HMAC-SHA256 signed webhook payloads
Mutual TLS for server-to-server API calls
Multi-region redundancy with automatic failover
Regional data residency options (EU, US, APAC)
Immutable audit logs for all verification events
Continuous vulnerability scanning and penetration testing
Dedicated security team with 24/7 incident response
Strict role-based access control (RBAC) on all internal systems
Customer data isolated per workspace — no cross-tenant access
Biometric templates never stored in raw form
Configurable data retention with automatic purging
Bug bounty programme with responsible disclosure policy
Annual third-party penetration test — results available on request
Security documentation
SOC 2 report, penetration test summaries, DPA templates, and our security whitepaper are available to qualified prospects under NDA.