Compliance

SOC 2

Status

BehalfID has not completed a SOC 2 Type I or Type II audit with a licensed CPA firm. We are implementing and documenting the organizational and technical controls required for a future SOC 2 engagement across the Security, Availability, Processing Integrity, and Confidentiality trust service criteria. SOC 2 Type II is a future target, not a current certification.

Controls in place today

The following technical controls are implemented across all BehalfID environments:

• All data in transit encrypted with TLS 1.2+
• Webhook payloads signed with HMAC-SHA256; signatures verified before processing
• Audit trail of every permission decision (agent ID, action, outcome, timestamp)
• Rate limiting on all public endpoints to prevent abuse

Roadmap

We intend to engage a licensed CPA firm for a SOC 2 Type II audit once remaining organizational controls and operating evidence are in place. Incident response, backup/restore, and BCP runbooks live under docs/compliance/ops/.

ISO 27001

Status

BehalfID has not yet obtained ISO 27001 certification. The technical controls required by ISO 27001 Annex A are substantially implemented (see Technical Controls below). Formal certification requires a documented ISMS, risk register, and third-party audit.

HIPAA

Status

BehalfID is not currently HIPAA-certified. The service is not intended for use in workflows that process Protected Health Information (PHI) as defined by HIPAA.

If you are building a health-adjacent application and need to route verification decisions through BehalfID, contact us to discuss whether a Business Associate Agreement (BAA) is appropriate for your use case.

GDPR

Status

BehalfID processes personal data of EU/EEA residents where developers (data controllers) use the service. As a data processor, BehalfID:

• Processes personal data only as instructed by the controller (the developer using BehalfID).
• Does not transfer EU personal data outside the EEA/UK without appropriate safeguards.
• Provides data subject rights mechanisms (access, deletion, portability) via the developer portal and by request to legal@behalfid.com.
• Maintains a record of processing activities.
• Notifies affected controllers within 72 hours of discovering a data breach.

Developers using BehalfID who process EU personal data in verification calls (e.g., passing a user ID as metadata) should ensure they have the appropriate legal basis and that a Data Processing Agreement (DPA) is in place. Email legal@behalfid.com to request a DPA.

CCPA / CPRA

Status

BehalfID does not sell personal information of California residents. BehalfID does not use personal data collected through the service for advertising or cross-context behavioral tracking.

California residents have the right to:

• Know what personal information BehalfID collects and how it is used.
• Delete personal information held by BehalfID.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information (BehalfID does not sell or share personal data).

To exercise these rights, email legal@behalfid.com.

Technical controls

The following technical controls are implemented across all BehalfID environments:

• All data in transit encrypted with TLS 1.2+
• API keys stored only as SHA-256 hashes — never in plaintext
• Developer passwords hashed with scrypt
• Session cookies are HTTP-only, SameSite=Lax, with a 1-hour inactivity window and 14-day absolute lifetime
• Webhook payloads signed with HMAC-SHA256; signatures verified before processing
• Verification logs retained by plan (Free 7 / Team 30 / Pro 90 / Business 180 / Enterprise up to 365 days) and physically purged after a grace period
• Rate limiting on all public endpoints to prevent abuse
• Audit trail of every permission decision (agent ID, action, outcome, timestamp)
• IP addresses used for rate limiting and security event logging; not sold or used for advertising
• Product analytics (HeyCatch) initialise only after analytics consent; no advertising trackers, no cross-site tracking, and session recording disabled