Identity verification handles the most sensitive data your customers will ever give you. Here's exactly what we do to keep it safe — published, not pitched.
Security capabilities
RFC 6238 authenticator-app 2FA with backup codes. Works with Google Authenticator, Authy, 1Password, and any compliant app.
Owners can require 2FA for every team member. Non-compliant accounts are blocked from the portal until they enroll.
Per-tenant SSO with Okta, Google Workspace, Azure AD, OneLogin, JumpCloud — any IdP that speaks SAML 2.0.
Every sensitive action — sign-ins, key rotations, settings changes, webhook config — recorded with actor, IP, timestamp, and metadata. Exportable as CSV.
Per-environment keys with granular scopes. Optional IPv4/IPv6 allowlists restrict each key to specific egress addresses.
Every webhook signed with HMAC-SHA256 using a per-endpoint secret. Exponential-backoff retry with full delivery log.
Members see every recent sign-in with device, IP, and method. One-click revocation of all active sessions across every device.
Single API call deletes a verification and all derived data. Customers can build complete data-subject deletion flows on top of our endpoint.
Compliance program
We don't claim certifications we don't hold. Here's our current status and roadmap. Auditors and security teams can email security@enemoverify.com for evidence requests.
SOC 2 Type I
In progressTarget: Q3 2026
SOC 2 Type II
PlannedTarget: Q1 2027
ISO 27001
PlannedTarget: Q3 2027
GDPR
CompliantCCPA
CompliantFCRA
CompliantSub-processors
| Provider | Purpose | Compliance |
|---|---|---|
| Vercel | Application hosting | SOC 2 Type II, ISO 27001 |
| Neon | PostgreSQL database | SOC 2 Type II |
| Sumsub | Verification backend | SOC 2, ISO 27001 |
| Stripe | Payments | PCI DSS Level 1 |
| Resend | Transactional email | SOC 2 Type II |
Documents
How we collect, use, store, and protect personal data.
The legal agreement governing use of EnemoVerify.
Every third party that processes data on our behalf.
Detailed controls grouped by category.
GDPR-compliant DPA template for EU customers.
Most recent third-party security assessment.
Current control mapping and certification timeline.
Pre-filled SIG Lite + CAIQ responses.
Vendor onboarding, security questionnaires, vulnerability reports, compliance evidence — one inbox, fast response.
security@enemoverify.comAverage first response: under one business day