Identity verification handles the most sensitive data your customers will ever give you. Here's exactly what we do to keep it safe — published, not pitched.
Security capabilities
RFC 6238 authenticator-app 2FA with backup codes. Works with Google Authenticator, Authy, 1Password, and any compliant app.
Owners can require 2FA for every team member. Non-compliant accounts are blocked from the portal until they enroll.
Per-tenant SSO with Okta, Google Workspace, Azure AD, OneLogin, JumpCloud — any IdP that speaks SAML 2.0.
Every sensitive action — sign-ins, key rotations, settings changes, webhook config — recorded with actor, IP, timestamp, and metadata. Exportable as CSV.
Per-environment keys with granular scopes. Optional IPv4/IPv6 allowlists restrict each key to specific egress addresses.
Every webhook signed with HMAC-SHA256 using a per-endpoint secret. Exponential-backoff retry with full delivery log.
Members see every recent sign-in with device, IP, and method. One-click revocation of all active sessions across every device.
Single API call deletes a verification and all derived data. Customers can build complete data-subject deletion flows on top of our endpoint.
Compliance program
We don't claim certifications we don't hold. Here's our current status and roadmap. Auditors and security teams can email security@enemoverify.com for evidence requests.
SOC 2 Type I
In progressTarget: Q3 2026
SOC 2 Type II
PlannedTarget: Q1 2027
ISO 27001
PlannedTarget: Q3 2027
GDPR
CompliantCCPA
CompliantFCRA
CompliantSub-processors
| Provider | Purpose |
|---|---|
| Vercel | Application hosting |
| Neon | PostgreSQL database |
| Sumsub | Verification backend |
| Stripe | Payments |
| Resend | Transactional email |
Documents
How we collect, use, store, and protect personal data.
The legal agreement governing use of EnemoVerify™.
Every third party that processes data on our behalf.
Detailed controls grouped by category.
GDPR-compliant DPA template for EU customers.
Most recent third-party security assessment.
Current control mapping and certification timeline.
Pre-filled SIG Lite + CAIQ responses.
Vendor onboarding, security questionnaires, vulnerability reports, compliance evidence — one inbox, fast response.
security@enemoverify.comAverage first response: under one business day