Regulatory Compliance

What Is Regulatory Compliance for Identity Verification?

Regulatory compliance in identity verification refers to meeting the legal requirements set by government authorities and industry bodies for verifying customer identities. This includes KYC (Know Your Customer), AML (Anti-Money Laundering), GDPR data protection, HIPAA healthcare privacy, and ISO 27001 information security standards. ID Analyzer helps businesses meet these requirements through automated document verification, biometric checks, and comprehensive audit trails.

GDPR Compliant

ID Analyzer follows the strict principal of data protection by design and by default, we have implemented stringent technical and organizational measures to protect all identity information processed through our service. We frequently conduct data protection impact assessment and have a strict internal security policy allowing only employees with top level clearances to access customer information once express permissions are given by you. To comply with GDPR, all our customers have access to EU API endpoint where transfer and storage of your customer's information will not go beyond EU borders. For processing and storage of personal information, we only work with well reputed datacenter providers that are GDPR compliant themselves.

ISO/IEC 27001

ISO/IEC 27001 is a security information security management standard published by International Organization for Standardization, aimed at making information held by organizations more secured. A series of complex audits must be assessed by a certification body in order for an organization to be certified for ISO 27001. ID Analyzer has been awarded ISO 27001 certification by BSI to ensure peace-of-mind of all our customers whilst using our services. To bolster the security of our service end-to-end, we only deal with third-party providers that are also IS0 27001 certified.

HIPAA Compliance

ID Analyzer is widely used by healthcare providers and insurer to verify the identity of onsite and remote customers especially in the tele-health industry. In short, implementing a patient/customer on-boarding solutions using ID Analyzer does not affect your entity's HIPAA compliant status, the simple reason is that your entity is only passing identity information to us, without any associated health information that could be linked to the person. We help you digitize and verify your user's identity, however, we do not process nor store any PHI set out under the HIPAA regulation of our customers. It is your organization's responsibility to store the identity information from ID Analyzer securely alongside the health information to stay HIPAA compliant.

NIST IAL-2 Aligned

ID Analyzer's ID Verification API and DocuPass, when setup correctly with biometric verification, satisfy all the digital identity requirements set out under IAL2 of NIST. IAL2 introduces the need for either remote or physically-present identity proofing, which can be obtained using using both of our ID + biometric verification solutions. With ID Analyzer, our API system automatically evaluates the real-world existence of identity claimed by you user, and verify that your user is appropriately associated with this real-world identity.

No Log Policy

As a SaaS provider, we have introduced a no log policy to ensure the peace of mind of all our customers whilst using our services. If you have disabled our vault storage system when accessing our services, we will not store any information, including all images or personal data, that you have uploaded to our server. This ensures that in an extremely rare case of security breach, the attacker will not get hold of any personal information of your customers.

How ID Analyzer Ensures Compliance

1. Configure Verification Rules

Configure verification rules matching your regulatory requirements, including document types accepted, biometric checks required, and AML screening thresholds for your jurisdiction.

2. Document and Biometric Verification

Customer completes document and biometric verification by submitting their government-issued ID and a live selfie for identity confirmation and liveness detection.

3. AML/PEP Screening

System performs AML/PEP screening against global databases including sanctions lists, politically exposed persons registers, and criminal watchlists to meet anti-money laundering requirements.

4. Audit Trail Generation

A complete audit trail is automatically generated for every verification, recording timestamps, decision outcomes, and supporting evidence required by regulators.

5. Encrypted Storage and Retention

Data is encrypted and stored per your configured retention policies, with options for automatic deletion, no-log processing, or secure vault storage to meet GDPR, HIPAA, and other data protection requirements.

Compliance at a Glance

Standard	Scope	Key Requirements Met
GDPR	EU Data Protection	Data minimization, right to erasure, consent management, DPA available
ISO 27001	Information Security	Encrypted storage, access controls, incident response, continuous monitoring
HIPAA	Healthcare Data	PHI protection, audit trails, access controls, BAA available
NIST IAL-2	Identity Assurance	Document verification, biometric matching, liveness detection