Signing keys are isolated
Private signing keys for each issuer are held in hardware-backed key storage and never exposed to browsers or client applications. Keys are not shared between issuers.
Trust
Security and assurance.
Credentials are only useful if the organisations checking them can rely on how they were made. This page covers the controls we operate and the material available for a supplier or procurement review.
Controls we operate
Described at the level a reviewer needs to assess the design.
Issuers are kept apart
Each issuer workspace is separated from the others, and credentials issued through Microsoft stay cryptographically distinct from credentials DiligenceID issues itself.
Nothing sensitive in the browser
Application secrets and administrative tokens stay on backend systems. Front-end applications hold no credentials that could be extracted from a device.
Actions are recorded
Administrative changes, issuance, withdrawal and checking outcomes are recorded with the actor, the resource and the result, so activity can be reviewed after the fact.
No central credential store
Issued credentials and the private keys binding them to a person are held on that person's own device. What the service does hold.
Destinations are validated
Where DiligenceID calls a customer endpoint or fetches published issuer information, the destination is validated first so it cannot be pointed at internal systems.
Evaluating DiligenceID as a supplier
These depend on your environment and your contract, so we confirm them in writing as part of an evaluation rather than publishing a figure you could not rely on.
Hosting and retention
Hosting region and retention periods form part of an engagement and are stated in the agreement. If data residency is a firm requirement, raise it early and we will confirm what is achievable.
Continuity and recovery
Continuity planning is documented and available for review. Recovery objectives are agreed per engagement so they match what your service actually needs.
Testing and vulnerability management
Testing scope, dates and findings are available to review under an evaluation, alongside how issues are triaged and tracked.
Support and incident response
Support hours, escalation paths and incident notification are agreed per engagement and written into the agreement.
Assurance status
Stated directly, for reviewers who need it on the record.
- Independent certification
- DiligenceID operates under the MAITS information management system, with documented architecture, key management, governance and continuity standards. It does not currently hold an ISO 27001 certificate or a SOC 2 report.
- Trust framework accreditation
- DiligenceID is not currently accredited under the New Zealand Digital Identity Services Trust Framework.
- Standards conformance
- The credential protocols are pinned to published specification versions and covered by an automated test suite. See the standards.
- Service availability
- Service levels are agreed contractually per engagement rather than advertised as a headline figure.
- Evaluation pack
- Available on request: the standards conformance register, architecture and key management standards, and written answers to your own security questionnaire. Request it.
Reporting
Found a security issue?
Email security@maits.co.nz with enough detail to reproduce it. Please keep personal information and credential contents to the minimum the report needs, and allow us a reasonable window to fix the issue before disclosing it publicly.
We will acknowledge your report and tell you what we intend to do about it.
Running a supplier or procurement review?
Send us your questionnaire. We will complete it and include the supporting material rather than pointing you at a brochure.