Security & Compliance
Credenti secures access across desktops, mobile, and offline environments with passwordless authentication, phishing-resistant MFA, and support for GDPR, HIPAA, SOC 2, and more—tailored to the needs of highly regulated organizations.
Our Security Commitment
- End-to-End Encryption: AES-256 encryption for data at rest and TLS 1.2+ with certificate pinning for data in transit.
- Tenant Isolation: Each customer’s data is protected with HSM-backed keys and isolated encryption domains.
- PII Protection: Controls like data minimization, access logging, and policy-bound access enforce the safeguarding of personally identifiable information (PII).
- Phishing-Resistant Authentication: Enforced device-bound FIDO2 passkeys and biometrics for secure user verification.
- Fallback Without Phones: Enable MFA via smartcards, desktop prompts, or policy-based methods—no phones or tokens required.
- Secrets & Key Management: Secrets are managed via AWS KMS or HashiCorp Vault with Kubernetes-native lifecycle enforcement and policy-controlled access.
- Real-Time Threat Detection: Behavioral monitoring and continuous diagnostics to detect anomalies and enforce policy at runtime.
- Zero Trust Enforcement: Fine-grained policy rules enforce least privilege access and step-up authentication where needed.
Security Certifications for Identity Compliance
SOC 1 Type II
Demonstrates that Credenti's controls relevant to Internal Control over Financial Reporting (ICFR) have been independently assessed over an extended audit period. Credenti supports these controls through strong access governance, role-based access controls, audit logging, change management, and administrative security controls.
View Credenti's independent SOC 1 Type II attestation:
Verified Credential SOC 1 Type II
Customers requiring additional SOC 1 documentation or the full report may request access through their Customer Success Manager (CSM) or Credenti sales representative.
SOC 2 Type II
Demonstrates that Credenti's security controls have been independently assessed over an extended audit period for the Security, Availability, and Confidentiality Trust Services Criteria. Credenti supports these controls through defense-in-depth security, encrypted data protection, continuous monitoring, and tenant isolation.
View Credenti's independent SOC 2 Type II attestation:
Verified Credential SOC 2 Type II
Customers requiring additional SOC 2 documentation or the full report may request access through their Customer Success Manager (CSM) or Credenti sales representative.
Compliance Standards We Support
TX-RAMP Level 2:
Credenti is TX-RAMP Level 2 certified, meeting the Texas Department of Information Resources (DIR) requirements for cloud services handling sensitive public-sector data. This certification validates Credenti’s security controls across identity, authentication, encryption, monitoring, and risk management—enabling seamless procurement by Texas state agencies and higher-education institutions.
Please use this link to download a copy of the TX-RAMP Level 2 certificate
ISO/IEC 27001:
Credenti’s Information Security Management System (ISMS) governs the unified Credenti product suite delivered as a Software-as-a-Service (SaaS) platform. The scope includes secure software development, infrastructure and cloud operations, data processing, and customer support activities. The ISMS is implemented in accordance with Credenti’s Statement of Applicability (Version 1.0) and is designed to ensure alignment with applicable legal, regulatory, and contractual security requirements.
Sarbanes–Oxley (SOX):
Credenti supports SOX compliance by enforcing strong access controls, detailed audit logging, and user accountability aligned with financial reporting integrity requirements.Assures internal controls over financial reporting are independently audited and validated. Credenti supports this by implementing strict access control, audit logging, and role-based delegation across its administrative features.
PCI DSS:
Credenti enables PCI DSS compliance by securing access to systems handling payment data with multi-factor authentication, strong encryption, and detailed access logs.Confirms controls for security, availability, and confidentiality are in place and operating effectively. Credenti enforces these principles through encrypted data flows, continuous monitoring, and tenant-level isolation.
GDPR:
Credenti supports GDPR compliance by helping organizations protect personally identifiable information (PII) through data minimization, user consent management, and audit-ready access logs for all user interactions.
NIST 800-63B:
Credenti implements identity assurance levels and secure authentication guidelines including phishing-resistant MFA as defined by NIST 800-63B.
HIPAA:
Credenti enforces HIPAA requirements with secure login workflows, audit trails, and access controls for electronic protected health information (ePHI).
CCPA:
Credenti enables CCPA compliance by facilitating user rights such as data access, deletion, and transparency around identity authentication and data usage.
NIS2 Directive:
Credenti supports identity-focused NIS2 requirements with access governance and zero-trust enforcement for critical infrastructure providers.
PSD2:
Credenti helps financial services meet PSD2 Strong Customer Authentication (SCA) mandates with multi-factor login flows and secure device-bound authentication methods.
FDA 21 CFR Part 11:
Supports compliance for electronic records and digital signatures in life sciences and healthcare environments. Credenti enables biometric authentication, timestamped audit trails, and user accountability for all actions.
Compliance-Ready Deployment Options
- SaaS (AWS): Hosted in U.S. and EU regions with AWS-native security, monitoring, and regional compliance support
- Private Cloud: Region-specific hosting with dedicated KMS and IAM
- On-Premise: Offline or air-gapped deployments for classified or sensitive data
- Org-level Isolation: Credenti supports isolated environments for sub-organizations, departments, or agencies, enabling strict separation of identity and access policies within a shared infrastructure.
Security Documents & Policies
External Testing & Controls
- Annual penetration tests by certified third-party firms
- SAST/DAST scans for code and application layers
- Audit trails for all authentication and policy events
- Immutable logs exportable to SIEM platforms