CHECKID · ARCHITECTURE

Technical Due-Diligence Pack

Entry point for RFI/RFP, architecture review, security assessment and procurement.

TECHNICAL REFERENCE

Technical Due-Diligence Pack

Entry point for RFI/RFP, architecture review, security assessment and procurement.

Product Architecture

System landscape, proofing, document/eID, biometrics, policy/assurance and evidence.

Security Review

Authentication contract, PAD scope, attack layers and publication limitations for transport/key/tenant controls.

Deployment & NFR

Support models, responsibility matrix and contract-defined availability/DR/scale.

Developer Contract

Token/subject/process/perform/status, errors and explicit webhook limitations.

Trust Evidence

Certificate basis remains distinct from current standards; Public Evidence Register preserves scope/exclusions.

Known Limitations

Benchmarks, webhooks, legal retention and device test profiles are not complete until primary sources exist.

Authoritative technical references

NIST SP 800-63-4 — Digital Identity GuidelinesFinal; July 2025
OpenID Identity Assurance Schema Definition 1.0 incorporating errata set 1Final; July 2026

Architecture Center

Architecture and boundaries.

↗

Security

Security architecture.

↗

Deployment/NFR

NFR and responsibility.

↗

Developer

Current contract.

↗

Evidence Register

Claim/evidence scope.

↗

Standards & Certification

Applicability and certificate basis.

↗

TECHNICAL DUE-DILIGENCE INDEX

Public, contractual, NDA and not published — make the boundary explicit

The Due-Diligence Pack lets procurement and CTO teams see what evidence is public and what requires contract/NDA access when the artefact actually exists.

Domain	Public	Contract/NDA boundary	Current position
Architecture	Architecture Center	Deployment-specific topology	Public system/trust-boundary model
Security	Public boundary + certificate scope	Control detail if approved pack exists	No invented TLS/HSM/isolation
API	CheckID API contract V1.2.260123/OpenAPI	Partner/customer classified access	OAuth2 current; legacy auth separated
SDK	Architecture overview	Release/method contract	Child docs consolidated
NFR/SLA	Boundary model	Approved NFR/SLA/deployment artefact	No invented RTO/RPO/TPS
Biometrics	Architecture/standards/methodology	Benchmark/test report	No context-free accuracy
Devices	Manufacturer-sourced capability	Mobile-ID tested matrix	Datasheet ≠ compatibility
Privacy/legal	Informational data-governance overview	Effective Legal/DPO notice/contract	No pseudo-policy completeness