Identity assurance
Controls for secure onboarding, reusable identity data, consent-based disclosure and robust evidence packages for verification decisions.
Security · Compliance · Transparency
Trust is not a feature.
It is the foundation of WeVerify.
Welcome to the WeVerify Trust Center. This page gives customers, auditors and partners a transparent view of how WeVerify protects identity, signature and verification workflows across people, processes, technology and suppliers.
- ISO 27001 documentation ready
- ETSI documentation ready
- GDPR by design
- eIDAS 2 aligned
- NIS2 mapped
- Audit-ready evidence
Overview
Designed for regulated digital trust workflows
WeVerify brings identity verification, business verification, authority checks, sanctions and PEP screening, customer due diligence, document generation and electronic signing into one secure platform. Our trust program is built to support customer due diligence, auditability, resilience and compliance across high-assurance digital transactions.
Signature assurance
Governance and technical documentation supporting electronic signature and trust service workflows under ETSI-aligned requirements.
Business verification
Processes for entity verification, representative authority checks, mandate validation and secure evidence retention for regulated workflows.
Secure integrations
API-first controls covering authentication, logging, monitoring, secure development and customer-controlled data exchange with audit trails.
Compliance
Compliance and assurance coverage
WeVerify maintains documentation across six compliance domains. Access to non-public materials may require a corporate email address, NDA and internal approval.
ISO/IEC 27001
Full information security management documentation: 93+ policies, Annex A control mapping, Statement of Applicability, internal audit evidence and management review records. All four Annex A domains covered: A.5 Organizational (37 controls), A.6 People (8), A.7 Physical (14), A.8 Technological (34).
ETSI
Trust service policy documentation, operational procedures, certificate lifecycle evidence, governance records and assessment support materials for electronic signature and seal services under eIDAS requirements.
GDPR
Privacy-by-design controls, data minimisation, purpose limitation, processor support agreements, data subject rights workflows, retention governance, DPIA support and personal data breach notification procedure aligned to Articles 33 and 34.
eIDAS / eIDAS 2 readiness
Assurance documentation for electronic identification, electronic signatures, electronic seals, audit trails and trust-service related workflows including EUDI Wallet interoperability preparation.
NIS2 and operational resilience
Security governance, supply chain oversight, incident response and reporting, business continuity, ICT continuity testing, vulnerability management and risk monitoring controls aligned to NIS2 essential entity requirements.
KYC, KYB and AML support
Evidence packages, verification reports and auditable workflows to support regulated customer onboarding and compliance operations suitable for AMLD6, PSD2, DORA and sector-specific requirements.
ISO 27001 Controls
Security control domains
WeVerify's ISO 27001 control library covers all four Annex A domains. Select a tab to explore the controls implemented across organizational, people, physical and technological security.
A.5 Organizational controls
Governance, risk management, policy framework, asset management, access control, supplier relationships, incident management, business continuity and legal compliance.
A.5.1
Policies for information security
Information Security Policy, Social Media Policy, HR Security Policy, Asset Management Policy, Acceptable Use Policy, Internet/Messaging/Collaboration Policies, Access Control Policy, Cryptographic Policy, Physical Security Policy, Anti-Malware Policy, Threat Intelligence Policy, Cloud Services Policy, Mobile Device and BYOD Policy, Remote Working Policy.
A.5.2
Information security roles and responsibilities
Defined roles and authority matrix; Information Security Roles, Responsibilities and Authorities document maintained and reviewed.
A.5.3
Segregation of duties
Segregation of Duties Guidelines prevent conflicts of interest in sensitive roles and system access rights.
A.5.4
Management responsibilities
Executive Support Letter, Whistleblowing Policy and management obligation to enforce information security requirements at all levels.
A.5.5
Contact with authorities
Maintained register of relevant authority contacts for incident escalation, regulatory reporting and legal liaison.
A.5.7
Threat intelligence
Threat Intelligence Policy, Process and periodic Reports covering threat actors, vulnerabilities and industry developments.
A.5.9
Inventory of information assets
Asset Management Policy and Information Asset Inventory covering all information assets, owners and classifications with PII tagging.
A.5.10
Acceptable use of assets
Acceptable Use Policy, Internet Access Policy, Electronic Messaging Policy, Online Collaboration Policy, Asset Handling Procedure, Procedure for Managing Lost or Stolen Devices.
A.5.12–14
Classification, labelling and transfer
Information Classification Procedure, Information Labelling Procedure, Information Transfer Procedure and Transfer Agreement template covering handling at each classification level.
A.5.15–18
Access control and identity management
Access Control Policy, User Access Management Process covering provisioning, periodic review, MFA enforcement and timely deprovisioning across all systems.
A.5.19–23
Supplier and cloud security
Information Security Policy for Supplier Relationships, Supplier Information Security Agreement, Due Diligence Assessment Procedure, Evaluation Process and Questionnaire. Cloud Services Policy, Process and Specifications for approved cloud providers.
A.5.24–27
Incident management
Incident Response Plans for Ransomware, Denial of Service and Data Breach; Information Security Event Assessment Procedure; Incident Response Procedure with defined roles, evidence preservation and post-incident review.
A.5.30
ICT readiness for business continuity
Business Impact Analysis Process and Report, ICT Continuity Plan, Exercising and Testing Schedule, ICT Continuity Test Plan and Test Report; tested at defined intervals.
A.5.31–34
Legal, privacy and records
Legal and Regulatory Requirements Procedure and Register, IP and Copyright Compliance Policy, Records Retention and Protection Policy, Privacy and Personal Data Protection Policy, Personal Data Breach Notification Procedure.
A.5.35–37
Audit, compliance and operations
Information Systems Audit Plan, Nonconformity and Corrective Action process, Information Security Summary Card and Operating Procedure ensuring systematic compliance enforcement and continual improvement.
A.6 People controls
Pre-employment screening, terms and conditions, disciplinary processes, confidentiality obligations, remote work and security event reporting.
A.6.1
Screening
Employee Screening Procedure covering identity verification, background checks and reference validation before employment commencement, proportionate to role sensitivity.
A.6.2
Terms and conditions of employment
Guidelines for Inclusion in Employment Contracts specifying information security obligations, confidentiality requirements and acceptable use terms.
A.6.3
Information security awareness, education and training
Awareness Training Presentation, Competence Development Procedure, Email and Passwords Awareness Posters; mandatory for all staff, tracked with Competence Development Report.
A.6.4
Disciplinary process
Employee Disciplinary Process covering information security policy violations with proportionate consequences, escalation path and documentation requirements.
A.6.5
Responsibilities after termination
Joiner-mover-leaver process includes NDA obligations, asset return, access revocation and post-employment confidentiality enforcement.
A.6.6
Confidentiality and non-disclosure agreements
Schedule of Confidentiality Agreements and Non-Disclosure Agreement template used with all employees, contractors and third parties with access to sensitive information.
A.6.7
Remote working
Remote Working Policy covering secure remote access, endpoint protection, screen privacy, home network security and incident reporting when working outside office premises.
A.6.8
Information security event reporting
Information Security Event Reporting Procedure enabling all personnel to report suspected or actual security events; integrated with event assessment and incident response chain.
A.7 Physical controls
Physical perimeter security, secure area access, equipment protection, media handling and disposal controls.
A.7.1
Physical security perimeters
Physical Security Policy and Physical Security Design Standards define perimeter controls for offices and data processing facilities including access barriers and surveillance.
A.7.2
Physical entry controls
Data Centre Access Procedure and Physical Security Design Standards govern visitor registration, badge access, escort requirements and access log maintenance.
A.7.4
Physical security monitoring
CCTV Policy governing camera placement, recording retention, access to footage and data subject rights compliance under GDPR.
A.7.6
Working in secure areas
Procedure for Working in Secure Areas defines activity restrictions, visitor supervision and clean-desk requirements within sensitive zones.
A.7.7
Clear desk and clear screen
Clear Desk and Clear Screen Policy mandating information-free workstations when unattended, locked screens and secure document storage.
A.7.9
Security of assets off-premises
Procedure for Taking Assets Offsite covering authorisation, transport security, remote access and reporting requirements for equipment used outside office premises.
A.7.10
Storage media
Procedure for Managing Removable Media, Physical Media Transfer Procedure and encryption requirements for all portable storage devices containing sensitive information.
A.7.11–13
Supporting utilities, cabling and maintenance
ICT Continuity Plan addresses power supply redundancy, UPS requirements and structured cabling standards. Availability Management Policy governs equipment maintenance scheduling and security during maintenance windows.
A.7.14
Secure disposal or re-use of equipment
Procedure for the Disposal of Media and Information Deletion Policy govern secure erasure, degaussing and physical destruction of media and equipment before disposal or re-use.
A.8 Technological controls
Endpoint security, access management, vulnerability management, configuration, data protection, logging, network security and cryptography.
A.8.1
User endpoint devices
Mobile Device Policy and BYOD Policy covering MDM enrollment, encryption, remote wipe, application controls and acceptable use for corporate and personal devices.
A.8.2–3
Privileged access and access restriction
Privileged Utility Program Register, User Access Management Process and Dynamic Access Control Policy govern assignment, review, logging and attribute-based access restrictions.
A.8.5
Secure authentication
Multi-factor authentication enforced for all remote access and privileged systems; authentication requirements embedded in Access Control Policy.
A.8.6
Capacity management
Capacity Plan covering compute, storage and network thresholds with monitoring alerts and scaling procedures to maintain availability SLAs.
A.8.7
Protection against malware
Anti-Malware Policy covering endpoint protection deployment, update cadence, scan scheduling, quarantine procedures and incident escalation paths.
A.8.8
Management of technical vulnerabilities
Technical Vulnerability Management Policy and Vulnerability Assessment Procedure covering CVE monitoring, patch prioritisation with SLA-based remediation and penetration test integration.
A.8.9
Configuration management
Configuration Management Policy, Process and Standard Templates ensure consistent, hardened and auditable system configurations across all environments.
A.8.10–12
Data deletion, masking and leakage prevention
Information Deletion Policy, Data Masking Policy and Process, Data Leakage Prevention Policy covering secure deletion standards, pseudonymisation techniques and DLP tooling for all environments.
A.8.13–14
Backup and availability
Backup Policy defining scope, frequency, encryption, offsite storage and restoration testing. Availability Management Policy and ICT Continuity Plan cover multi-zone deployment, failover and RTO/RPO targets.
A.8.15–16
Logging and monitoring
Logging and Monitoring Policy defining mandatory log types, retention periods, integrity protection and SIEM integration. Monitoring Policy covering continuous infrastructure monitoring, anomaly detection and on-call response.
A.8.19–23
Software, networks and web security
Software Policy, Network Security Policy, Network Services Agreement, Web Filtering Policy governing approved software, network segmentation, DMZ design, firewall rules and URL filtering.
A.8.24
Use of cryptography
Cryptographic Policy defining approved algorithms, key lengths, key management, certificate lifecycle and prohibited cipher suites for all data in transit and at rest.
A.8.25–31
Secure development lifecycle
Security requirements embedded in SDLC: threat modelling, code review, SAST/DAST scanning, OWASP Top 10 coverage, environment separation enforced in infrastructure and security sign-off gates for all production releases.
A.8.32
Change management
Change Management Process covering request, risk assessment, approval, testing, rollback planning and post-change review for all infrastructure and application changes.
Security program
How we protect your data and workflows
WeVerify operates a defence-in-depth security program covering encryption, access management, secure development, vulnerability management and independent testing. The program is governed by the ISMS and reviewed annually by senior management.
Encryption
All personal data and verification payloads are encrypted at rest using AES-256. All data in transit is protected using TLS 1.2 or higher with approved cipher suites. Key management, algorithm selection and prohibited ciphers are governed by the Cryptographic Policy.
Access management
Multi-factor authentication is enforced for all remote access and privileged systems. Access is provisioned on a least-privilege basis with role-based controls, periodic access reviews and automated deprovisioning on role change or departure. Privileged access is logged and monitored.
Secure development lifecycle
Security requirements are embedded throughout the SDLC. Threat modelling, static application security testing (SAST), peer code review, dependency scanning and OWASP Top 10 coverage are applied before any production release. Production, staging and development environments are strictly separated. All releases require a security sign-off gate.
Change management
All infrastructure and application changes follow the Change Management Process: request, risk assessment, approval, testing, rollback planning and post-change review. Emergency changes are subject to retrospective review. Unauthorised or ad-hoc changes are prohibited in production.
Vulnerability management
Automated vulnerability scanning runs continuously across infrastructure and application layers. Critical and high-severity findings are remediated within defined SLAs. The Technical Vulnerability Management Policy and Vulnerability Assessment Procedure govern scan scope, finding triage, patch prioritisation and exception handling.
Penetration testing
WeVerify commissions independent third-party penetration tests at least annually. Tests cover application, API, network and infrastructure scope using OWASP and PTES methodologies. Findings are tracked through to remediation. Summary test scope and remediation status are available to customers under NDA on request via security@weverify.com.
Responsible disclosure
WeVerify operates a responsible disclosure programme. If you discover a potential security vulnerability in any WeVerify product or infrastructure, please report it to security@weverify.com with a description, reproduction steps and potential impact. We acknowledge reports within 5 business days and aim to resolve confirmed vulnerabilities within 90 days. We ask researchers to avoid data access, service disruption or disclosure to third parties during investigation.
Logging and monitoring
All production systems generate security-relevant logs covering authentication events, access to personal data, configuration changes and system errors. Logs are protected against tampering, retained for defined periods under the Logging and Monitoring Policy, and integrated into continuous monitoring. On-call procedures ensure 24/7 alerting for critical events.
Threat intelligence
WeVerify operates a Threat Intelligence Policy and Process covering monitoring of threat actor activity, CVE feeds, industry advisories and sector-specific intelligence sources relevant to identity verification and digital signing. Findings feed directly into vulnerability management prioritisation and risk assessment updates.
Endpoint and device security
Mobile Device Policy and BYOD Policy govern device enrollment, encryption, remote wipe capability and application controls. Anti-Malware Policy requires endpoint protection on all managed devices with defined update cadence and incident escalation. Clear Desk and Clear Screen Policy applies across all office locations.
Law enforcement requests
WeVerify responds to lawful requests from law enforcement and competent authorities in accordance with applicable law. Requests must be submitted in writing with legal basis to compliance@weverify.com. WeVerify will notify affected customers of requests unless prohibited by law or court order. We reserve the right to challenge requests that are overly broad, unlawful or disproportionate.
Security contact
For security incidents, suspected vulnerabilities or urgent security concerns: security@weverify.com. For compliance and audit requests: compliance@weverify.com. For privacy matters: privacy@weverify.com.
Availability & resilience
Infrastructure resilience and continuity
WeVerify's platform is built on EU-based cloud infrastructure with multi-zone redundancy, automated failover and formally tested business continuity and ICT continuity plans. Availability is monitored continuously with defined on-call escalation paths.
EU data residency
All personal data processed and stored within the European Economic Area. Data residency is enforced at infrastructure level. No personal data is transferred outside the EEA without a lawful transfer mechanism in place.
EEA only
Multi-zone deployment
Production workloads are deployed across multiple availability zones within the EU. Automated health checks, load balancing and failover ensure continuity in the event of zone-level disruption without requiring manual intervention.
Active redundancy
Backup and recovery
The Backup Policy defines scope, frequency, encryption, offsite storage requirements and restoration test schedules. Backups are encrypted and stored separately from primary systems. Recovery procedures are tested at defined intervals against documented RTO and RPO targets.
Tested & encrypted
ICT continuity
WeVerify maintains an ICT Continuity Plan aligned to ISO 27001 A.5.30, covering critical system identification, recovery priorities, escalation chains and alternative processing arrangements. The plan is exercised annually and updated following each test.
Exercised annually
Business impact analysis
A formal Business Impact Analysis identifies critical processes, acceptable recovery time objectives and dependencies. Findings drive continuity planning priorities and are reviewed as part of the annual management review cycle.
ISO 27001 A.5.30
Capacity management
The Capacity Plan sets thresholds for compute, storage and network resources with automated alerts and scaling procedures. Capacity is reviewed regularly to ensure availability SLAs can be maintained under peak load and growth scenarios.
Auto-scaling
Policy library
Documentation inventory
WeVerify maintains 93+ ISMS documents covering all ISO 27001 clause requirements and Annex A controls. Access to non-public policies requires a signed NDA and approval.
ISO 27001 full policy packageAll 93+ ISMS documents and Annex A evidence
→
Statement of ApplicabilityControl selection rationale and implementation status
→
Risk Assessment ReportMethodology, findings and risk treatment decisions
→
ETSI documentation packageTrust service procedures and evidence
→
Business Continuity and ICT Continuity PlanRTO/RPO targets, test results, BIA report
→
Sub-processor and supplier registerVendor risk and supply chain controls
→
Internal audit evidenceMost recent internal audit report and plan
→
Penetration test summaryScope, findings summary and remediation status
→
| Document ID | Policy / Procedure | Standard area |
|---|---|---|
| Core ISMS — Clauses 4 to 10 | ||
| ISMS-DOC-04-1 | Information Security Context, Requirements and Scope | Cl. 4 |
| ISMS-DOC-05-1 | Information Security Management System Manual | Cl. 5, 7 |
| ISMS-DOC-05-2 | Information Security Roles, Responsibilities and Authorities | Cl. 5.3 / A.5.2 |
| ISMS-DOC-05-3 | Executive Support Letter | Cl. 5.1 |
| ISMS-DOC-05-4 | Information Security Policy | Cl. 5.2 / A.5.1 |
| ISMS-DOC-06-1 | Information Security Objectives and Plan | Cl. 6.1, 6.2 |
| ISMS-DOC-06-2 | Risk Assessment and Treatment Process | Cl. 6.1, 8.2 |
| ISMS-DOC-06-3 | Risk Assessment Report | Cl. 6.1, 8.2 |
| ISMS-DOC-06-4 | Risk Treatment Plan | Cl. 6.1, 8.3 |
| ISMS-FORM-06-2 | Statement of Applicability | Cl. 6.1.3 |
| ISMS-DOC-06-5 | ISMS Change Process | Cl. 6.3 |
| ISMS-DOC-07-1 | Information Security Competence Development Procedure | Cl. 7.2 |
| ISMS-DOC-07-2 | Information Security Communication Programme | Cl. 7.4 |
| ISMS-DOC-07-3 | Procedure for the Control of Documented Information | Cl. 7.5 |
| ISMS-DOC-08-1 | ISMS Process Interaction Overview | Cl. 4.4, 8.1 |
| ISMS-DOC-09-2 | Procedure for Internal Audits | Cl. 9.2 / A.5.35 |
| ISMS-DOC-09-3 | Internal Audit Plan | Cl. 9.2 |
| ISMS-DOC-09-4 | Procedure for Management Reviews | Cl. 9.3 |
| ISMS-DOC-10-1 | Procedure for the Management of Nonconformity | Cl. 10.2 |
| A.5 Organizational controls | ||
| ISMS-DOC-A05-01-1 | Social Media Policy | A.5.1 |
| ISMS-DOC-A05-01-2 | HR Security Policy | A.5.1 |
| ISMS-DOC-A05-03-1 | Segregation of Duties Guidelines | A.5.3 |
| ISMS-DOC-A05-04-1 | Information Security Whistleblowing Policy | A.5.4 |
| ISMS-DOC-A05-07-1 | Threat Intelligence Policy | A.5.7 |
| ISMS-DOC-A05-07-2 | Threat Intelligence Process | A.5.7 |
| ISMS-DOC-A05-09-1 | Asset Management Policy | A.5.9 |
| ISMS-DOC-A05-09-2 | Information Asset Inventory | A.5.9, A.5.34 |
| ISMS-DOC-A05-10-1 | Acceptable Use Policy | A.5.10 |
| ISMS-DOC-A05-10-2 | Internet Access Policy | A.5.10 |
| ISMS-DOC-A05-10-3 | Electronic Messaging Policy | A.5.10, A.5.14 |
| ISMS-DOC-A05-10-6 | Online Collaboration Policy | A.5.10, A.5.14 |
| ISMS-DOC-A05-12-1 | Information Classification Procedure | A.5.12 |
| ISMS-DOC-A05-13-1 | Information Labelling Procedure | A.5.13 |
| ISMS-DOC-A05-14-1 | Information Transfer Procedure | A.5.14 |
| ISMS-DOC-A05-15-1 | Access Control Policy | A.5.15 |
| ISMS-DOC-A05-18-1 | User Access Management Process | A.5.18 |
| ISMS-DOC-A05-19-1 | Information Security Policy for Supplier Relationships | A.5.19 |
| ISMS-DOC-A05-20-1 | Supplier Information Security Agreement | A.5.20 |
| ISMS-DOC-A05-21-1 | Supplier Due Diligence Assessment Procedure | A.5.21 |
| ISMS-DOC-A05-22-1 | Supplier Information Security Evaluation Process | A.5.22 |
| ISMS-DOC-A05-23-1 | Cloud Services Policy | A.5.23 |
| ISMS-DOC-A05-24-1 | Incident Response Plan — Ransomware | A.5.24 |
| ISMS-DOC-A05-24-2 | Incident Response Plan — Denial of Service | A.5.24 |
| ISMS-DOC-A05-24-3 | Incident Response Plan — Data Breach | A.5.24 |
| ISMS-DOC-A05-26-1 | Information Security Incident Response Procedure | A.5.26 |
| ISMS-DOC-A05-30-4 | ICT Continuity Plan | A.5.30 |
| ISMS-DOC-A05-30-2 | Business Impact Analysis Report | A.5.30 |
| ISMS-DOC-A05-31-2 | Legal, Regulatory and Contractual Requirements Register | A.5.31 |
| ISMS-DOC-A05-34-1 | Privacy and Personal Data Protection Policy | A.5.34 / GDPR |
| ISMS-DOC-A05-34-2 | Personal Data Breach Notification Procedure | A.5.34 / Art.33 |
| A.6 People controls | ||
| ISMS-DOC-A06-01-1 | Employee Screening Procedure | A.6.1 |
| ISMS-DOC-A06-02-1 | Guidelines for Inclusion in Employment Contracts | A.6.2 |
| ISMS-DOC-A06-04-1 | Employee Disciplinary Process | A.6.4 |
| ISMS-DOC-A06-06-2 | Non-Disclosure Agreement | A.6.6 |
| ISMS-DOC-A06-07-1 | Remote Working Policy | A.6.7 |
| ISMS-DOC-A06-08-1 | Information Security Event Reporting Procedure | A.6.8 |
| A.7 Physical controls | ||
| ISMS-DOC-A07-01-1 | Physical Security Policy | A.7.1 |
| ISMS-DOC-A07-02-1 | Physical Security Design Standards | A.7.2 |
| ISMS-DOC-A07-03-1 | Data Centre Access Procedure | A.7.2 |
| ISMS-DOC-A07-04-1 | CCTV Policy | A.7.4 |
| ISMS-DOC-A07-07-1 | Clear Desk and Clear Screen Policy | A.7.7 |
| ISMS-DOC-A07-10-1 | Procedure for the Management of Removable Media | A.7.10 |
| ISMS-DOC-A07-14-1 | Procedure for the Disposal of Media | A.7.14 |
| A.8 Technological controls | ||
| ISMS-DOC-A08-01-1 | Mobile Device Policy | A.8.1 |
| ISMS-DOC-A08-01-2 | BYOD Policy | A.8.1 |
| ISMS-DOC-A08-07-1 | Anti-Malware Policy | A.8.7 |
| ISMS-DOC-A08-08-1 | Technical Vulnerability Management Policy | A.8.8 |
| ISMS-DOC-A08-09-1 | Configuration Management Policy | A.8.9 |
| ISMS-DOC-A08-10-1 | Information Deletion Policy | A.8.10 |
| ISMS-DOC-A08-12-1 | Data Leakage Prevention Policy | A.8.12 |
| ISMS-DOC-A08-13-1 | Backup Policy | A.8.13 |
| ISMS-DOC-A08-15-1 | Logging and Monitoring Policy | A.8.15 |
| ISMS-DOC-A08-20-1 | Network Security Policy | A.8.20 |
| ISMS-DOC-A08-24-1 | Cryptographic Policy | A.8.24 |
| ISMS-DOC-A08-32-1 | Change Management Process | A.8.32 |
Privacy & GDPR
Data protection and privacy controls
WeVerify processes personal data as both a controller and processor. Our privacy program is embedded in our ISMS and aligned to GDPR, eIDAS and applicable national data protection requirements.
Privacy by design and default
Privacy impact is assessed during product design. Data minimisation, purpose limitation and storage limitation are embedded in architecture and API design. Consent-based disclosure is the default for all identity verification outputs.
Data subject rights
WeVerify supports data subject access, rectification, erasure and portability requests through documented workflows. Response timelines comply with GDPR Article 12. Contact privacy@weverify.com to submit a request.
Data Processing Agreement
All customers acting as controllers receive a Data Processing Agreement (DPA) under GDPR Article 28 defining processing scope, sub-processor lists, security measures, audit rights, breach notification timelines and Standard Contractual Clauses for any third-country transfers. Request the DPA via compliance@weverify.com.
Breach notification
Personal Data Breach Notification Procedure covers detection, impact assessment, supervisory authority notification within 72 hours (Art. 33), affected individual notification (Art. 34) and post-incident review. Customers are notified without undue delay following confirmation of a breach affecting their data.
Audit rights
Customers and their designated auditors may request audit evidence, compliance documentation and security certifications. Audits are conducted with reasonable advance notice. WeVerify provides responses to security questionnaires, vendor assessments and due diligence requests via compliance@weverify.com.
Data transfers
Personal data is processed and stored in the European Economic Area. Cross-border transfers require a legal transfer mechanism. Sub-processor locations are disclosed in the sub-processor register available on request.
Retention and deletion
Records Retention and Protection Policy and Information Deletion Policy define retention periods per data category. Automated deletion workflows enforce retention end dates with secure erasure standards applied on deletion and equipment disposal.
DPIA support
WeVerify can support customer Data Protection Impact Assessment processes with technical documentation, processing descriptions and security measure summaries. Request DPIA support via security@weverify.com.
Sub-processors
WeVerify uses a limited set of approved sub-processors for cloud infrastructure, identity data sources and operational tooling. The current sub-processor register is available to customers under a Data Processing Agreement.
Sub-processors
Supply chain and sub-processor oversight
WeVerify maintains a Supplier Information Security Policy, Supplier Due Diligence Assessment Procedure and Supplier Evaluation Questionnaire for all third-party providers. Customers operating under a Data Processing Agreement receive advance written notice before any new sub-processor is engaged and may raise objections during the notice period. The full register including specific provider names is available to customers under a Data Processing Agreement.
Cloud infrastructure provider
EU / EEA
Compute, storage and networking for WeVerify platform environments including production, disaster recovery and backup. Subject to Supplier Information Security Agreement and annual security evaluation.
Identity document data sources
EU / EEA
Official government and registry sources used for document verification, entity lookup and representative authority checks. Data access is governed by bilateral agreements compliant with eIDAS interoperability requirements.
Certificate authority and PKI provider
EU
Trusted certificate authority supporting electronic signature and ETSI-aligned operations. Subject to ETSI-aligned governance and certificate lifecycle controls under the Cryptographic Policy.
Monitoring and observability
EU / EEA
Infrastructure monitoring, log aggregation, alerting and availability tracking. Data limited to operational metrics and anonymised log data covered under Logging and Monitoring Policy.
Customer communication platform
EU / EEA
Transactional email and notification delivery for customer-facing communications. No personal data from verification workflows is transmitted. Subject to Electronic Messaging Policy and Supplier Information Security Agreement.
ETSI
Trust service documentation
WeVerify supports electronic signature and electronic seal workflows under eIDAS. The documentation package covers trust service policy, operational procedures, certificate lifecycle governance and evidence management.
Trust service policy and CPS
Certificate Policy and Certification Practice Statement governing issuance, management, renewal and revocation of certificates. Available to eligible stakeholders under NDA.
Certificate lifecycle management
End-to-end certificate lifecycle procedures: enrollment, validation, issuance, renewal, suspension and revocation aligned to ETSI EN 319 401 and EN 319 411 requirements.
Signature and seal
Technical and procedural documentation for electronic signature and seal creation, including signatory identity assurance, sole control mechanisms and signature evidence bundle generation.
Audit and conformity assessment
Conformity assessment documentation, audit schedules and ETSI-aligned evidence packages for supervisory body engagement.
eIDAS 2 and EUDI Wallet readiness
Documentation tracking alignment with eIDAS 2 regulation including EUDI Wallet integration, PID attestation and attribute release governance.
Incident and disruption management
Trust service specific incident classification, notification procedures for supervisory authority and subscribers, and business continuity provisions for service availability.
Updates
Trust and compliance updates
Key milestones, documentation updates and compliance events for customers and partners.
July 2026
Trust Center launched
WeVerify launches a dedicated Trust Center providing transparent security, compliance and policy documentation for customers, auditors and partners.
July 2026
ISO 27001 documentation package available
Complete ISO 27001 policy set (93+ documents) including Annex A control coverage, Statement of Applicability and risk assessment evidence available under controlled access.
July 2026
ETSI documentation package available
Trust service documentation package, including trust service policy, certificate lifecycle procedures and conformity assessment support materials, available to eligible enterprise stakeholders.
July 2026
Sub-processor register published
Current sub-processor categories with EU/EEA data residency disclosures published. Full register with provider names available under Data Processing Agreement.
Request access
Need audit evidence or compliance documents?
Use the form to request secure access to WeVerify's documentation library. We respond within 2 business days. Restricted documents may require NDA review and approval.
- ISO 27001 policy package and Annex A evidence
- Statement of Applicability
- Risk Assessment Report and Treatment Plan
- ETSI documentation package
- Business Continuity and ICT Continuity Plan
- Penetration test summary (scope, findings, remediation status)
- Sub-processor full register
- Data Processing Agreement (DPA)
- Standard Contractual Clauses
- Vendor / third-party risk questionnaire response
- Security questionnaire completion support
- DPIA support documentation