Security governance, encryption boundaries, access controls and operational assurance.
Client → transport → API edge → identity services → evidence → relying party
The current CheckID API source uses OAuth2 Client Credentials for token retrieval and Bearer authorization for partner operations. Legacy AWS Signature material is superseded by V1.2.260123 and is not current integration guidance.
TLS/mTLS versions, cipher suites, certificate rotation and network allowlisting are published only with security/deployment sources. Public documentation does not assume mTLS or a specific TLS profile.
Database/object-store encryption, HSM boundaries, key ownership and rotation require security-architecture evidence. ISO 27001 certification does not itself define CheckID’s cryptographic topology.
Tenant isolation, administrative RBAC/MFA, segregation of duties, approvals and delegated support require security/admin evidence. Without it, Current documentation records a publication limitation rather than asserting implementation.
SAST/DAST/SCA, penetration testing, patching and release controls are public claims only when SDLC/security evidence supports them; they are not inferred from a management-system certificate.
A security-reporting route may be public, but severity SLAs, notification timing and forensic procedures must follow approved policy or contract sources.
The public Security Architecture describes a control as implemented only when Tier-1 evidence supports it. Missing approved sources become disclosure boundaries rather than inferred controls.
| Control domain | Public evidence | Public position |
|---|---|---|
| API authentication | CheckID API contract V1.2.260123 | OAuth2 Client Credentials + Bearer; AWS Signature V4 is legacy documentation. |
| Transport | No approved profile in the package | No TLS/mTLS version/cipher asserted as fact. |
| At-rest / key management | No approved security architecture | No encryption/HSM topology claim. |
| Tenant / privileged controls | No approved control matrix | No isolation/MFA/SoD/support-workflow claim. |
| Certification | Certificate register | Certificates are not expanded into whole-platform security claims. |
Customer clients, API edge, CheckID processing, authoritative third parties and RP backends are distinct boundaries. Credential/service responsibility depends on the deployment/integration contract.
Presentation attacks, capture injection, client compromise, API/channel replay and identity/evidence fraud are separate layers. PAD maps only to the evaluated presentation scope.
Security and operational logs are not automatically identity evidence. Correlation, integrity and retention are asserted only from source evidence.
Control detail may be PUBLIC, PUBLIC SUMMARY, CONTRACTUAL or NDA; a security pack is referenced only if the artefact actually exists.
