Skip to main content

Help us improve the Digital Marketplace - send your feedback

iProov Limited

iProov Decentralised Identity Solution

iProov Decentralised Identity enables governments to verify identity and issue reusable credentials to a smartphone for multi-factor authentication throughout the identity lifecycle. Ready-made iproov.me ID wallet app or SDK for existing mobile apps. No-code integration for OIDC-supported applications. Supports WC3 Verifiable Credentials, Right to Work, Right to Rent, DBS.

Features

  • Issue, update, or revoke Verifiable Credentials to mobile wallet apps.
  • Secure remote digital onboarding of end-users using facial biometrics.
  • Identity proofing using NFC-extraction of government issued ID-documents.
  • Risk-based multifactor cryptographic biometric authentication of end-users.
  • Re-verification of end-users with secure real-world identity linkage.
  • Privacy-preserving management of end-user identity credentials.
  • Selective disclosure of cryptographically verifiable claims.
  • GDPR-consent management mechanism.
  • Device-based attribute storage and management with AES-256 encryption
  • Full compliance with OIDC for easy integration of Relying Parties.

Benefits

  • Certified to UK Digital Identity and Attributes Trust Framework.
  • Reusability: Onboard once, and reuse many times.
  • Privacy: Gives citizens/employees greater control over their own data.
  • Fraud: Reduces rates of identity fraud including deep-fakes.
  • Cost: Reduces the total cost of ownership managing citizens/employees.
  • Eliminate the use of passwords and costly hardware-based tokens.
  • Simplifies the process of updating and revoking attributes and accreditations.
  • Auditable consent for data sharing to assist with GDPR compliance.
  • Supports Passports, residence cards, and National IDs from 145 countries
  • Leverages smartphone NFC technology to read ICAO 9303 standard documents.

Pricing

£0.08 to £2.00 a transaction

  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@iproov.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

6 4 2 9 9 5 7 3 4 7 2 6 3 8 9

Contact

iProov Limited Matthew Pearch
Telephone: +44 20 7993 2379
Email: contact@iproov.com

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
- IDV
- VPN access
- Authentication
- Identity Management & Access Management
- Document capture processes - contactless or optical
- Multi-stage Identity Verification processes
- Border Control processes
- Fraud & Risk Management systems
Cloud deployment model
  • Public cloud
  • Private cloud
Service constraints
IProov.me supports iOS 13 and later software
iProov.me supports iPhone 7 and later models
Android 8.0 and later software
Requires an internet connection, NFC-reading capabilities, and a browser (web or mobile).
System requirements
  • Credentials SDK Requirements
  • Flutter 3.13.4+
  • Dart 3.1.2+
  • IOS 12.0+
  • Android API Level 23+

User support

Email or online ticketing support
Email or online ticketing
Support response times
Response times are agreed within the chosen service package
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
None or don’t know
Phone support
No
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
See the iProov pricing document for details on the support level packages and their pricing
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Relying Parties are granted access by the iProov customer onboarding team to the iPortal. Once registered, their users can create their own OIDC applications with various settings and custom workflows to begin technical evaluation. End users download the iProov.me mobile app, freely available from Apple and Android App Stores, remotely onboarding to the Relying Party’s OIDC application. If preferred, end users can utilise a demo user within the app instead of a real enrolment.

To start a proof of concept (PoC), a pilot, or production usage, Users must have a commercial contract in place. This is easily arranged with the iProov customer onboarding team.

At the end of any evaluation period, PoC, or contract the Relying Party may delete their account on the iPortal.

Relying Parties who would prefer to embed the iProov Credentials SDKs into their own application are supported through a dedicated project.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
IProov.me is a decentralised identity platform, with the user's identity data stored in wallet functionality within the App, held on-device. Users may consent to the sharing of their identity data with a Relying Party during the contract period. Users may continue to use the iProov.me App even at the end of contract.

When an end user deletes their account or uninstalls iProov.me, their identity data is permanently erased.
End-of-contract process
If the government body terminates the contract, they will lose the ability to use iProov.me or its integrated Credentials SDK for citizen or employee verification. While historical data shared with relying parties will remain accessible to those parties, the government will no longer be able to utilise the service for authenticating identity data or accessing verifiable credentials stored within citizens' and employees' wallets.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
IProov.me (ID-wallet App)/ Credentials SDKs are optimized for iOS and Android device usage.
Service interface
Yes
User support accessibility
None or don’t know
Description of service interface
IProov identity is managed via the iProov Portal.
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
IProov has carried out testing of compatibility with voice over tools (native for iOS and 3rd party apps for Android and devices using browsers).
API
Yes
What users can and can't do using the API
The service is accessed by users over Open ID Connect API which is a standard online authentication API and comes with multiple different libraries making integration easy.

Included:
Via the iPortal Authorised administrators have the ability to create, modify and delete OIDC-applications through their lifecycle

Limitation would be:
Authorised administrators are not able to enroll new End-Users nor to see any identity data stored on the End-users’ devices.
API documentation
Yes
API documentation formats
  • Open API (also known as Swagger)
  • HTML
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
The iProov.me Authenticator app can be customized with a co-branding feature that prominently displays the user's details.

The End-user attribute requirements can be specified via the iPortal to create custom enrolment and authentication flows within the iProov.me app.

Embedded in the service provider's application, the iProov Credentials SDKs provide extensive customisation options, ensuring a seamless and personalised user experience.

Scaling

Independence of resources
IProov has active capacity management to ensure that provisioned capacity exceeds the forecast system load by a safety margin. Rapid provisioning to meet short-term load peaks is available. High peak capacity testing has been performed in the context of existing Government and private sector projects.

Analytics

Service usage metrics
Yes
Metrics types
IPortal is iProov's customer engagement portal: It is a secure platform giving our customers and partners a single point of access to carry out crucial purposes including; service metrics, user administration, automated service provisioning, integration, reporting, access to dashboards and raising support tickets.

Service metrics will comprise:
-number of NFC-document reading transactions in the period
-number of Authentications in the period
-number of Express/Dynamic Liveness transactions in the period
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Within the system, end-users have full control over their identity data stored in the digital wallet on their device. They can choose to share this data with a relying party when necessary. iProov focuses solely on verifying the user's liveness during these interactions. We don't store any of the actual identity data being shared between the user and the relying party. Since iProov doesn't retain any identity data there's no user data to export from our system
Data export formats
Other
Other data export formats
No export appropriate
Data import formats
Other
Other data import formats
To be agreed between the parties

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
There is a documented remedy and liability process which is detailed in the service credit and performance appendix in the contract.

Bronze: 99.5%,

Silver: 99.9%,

Gold: 99.95%,

Pro Platinum 99.95%.

All service availability levels are measured over a 12-month period.
Approach to resilience
Availability is engineered by multiple layers of redundancy both within datacentre and across multiple locations running active/active. Further details are available upon request.
Outage reporting
Email alerts of outages are sent to nominated contacts within the Service Provider's organisation and service availability is included within the API.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication
Service Provider users authenticate using the iProov service by 2FA, two-way TLS, VPN and username or password can be used to access relevant parts of the service as authorised or required.
Access restrictions in management interfaces and support channels
Access to management interfaces and support channels is limited to authorised users nominated by the service provider.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Certification Europe (UKAS)
ISO/IEC 27001 accreditation date
20/03/2024
What the ISO/IEC 27001 doesn’t cover
Out of scope items are loading bays and outsourced development
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
No
Cyber essentials plus
No
Other security certifications
Yes
Any other security certifications
  • ISO/IEC 30107-3:2017 and ISO/IEC 19795-1:2006 compliant
  • NIST 800-63B compliant as reviewed by National Physical Laboratory (NPL).
  • Biometric verification ETSI EN319 411-1 and ETSI EN319 411-2
  • SOC 2 Type II
  • ISO 9001

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
IProov in its entirety, including all products, is certified to ISO/IEC 27001(2013). Internal and external auditing is carried out on a regular basis with external audits taking place twice annually.

A member of the Senior Leadership Team (SLT) has specific responsibility for security and reporting is carried out through the SLT to the CEO and board.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
Change management baselines are established via version control and via asset records. Where a change is requested or made the base line is evaluated and updated as needed alongside a record of the change. iProov's change management process requires approvals from relevant stakeholders before assets are changed or updated. iProov's risk management process is integrated with its change management procedure which includes all internal and external assets.
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
IProov maintains high standards of vulnerability management. We update detection tools and vulnerability detection processes regularly, ensuring robust security operations. We adhere to timescales defined in our SOC 2,eIDAS,IRAP AND ISO27001 certifications, and comply with NIS 2 guidelines. We conduct daily vulnerability scans using Nessus and Snyk, with performance reviews performed at least every 90 days. We utilise Crowdstrike for real-time malware detection on endpoints. Our response time for vulnerabilities range from 24 hours for critical issues to 90 days for low risk concerns.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
Potential compromises are identified through both automated alerting and manual log review. Suspected or identified compromise response follows ISO27002:2014 section 16.1 which will result in immediate 24x7 initiation of an incident response team if required.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
Incident processes and procedures exist for common events. Customers may report incidents by email, raising a P1 ticket of voice. Incident response and reporting follows ISO27002:2016 section 16.1

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Social Value

Social Value

Social Value

  • Fighting climate change
  • Equal opportunity
  • Wellbeing

Fighting climate change

iProov's commitment to a corporate environmental framework is evidenced through the specialised component of our Carbon Reduction Plan inline with PPN 06/21 this is published on the website and updated regularly. iProov is committed to achieving Net Zero emissions by 2050.

Equal opportunity

Since the inception of iProov, we have dedicated ourselves to being an equal-opportunity employer. We have built an accessible workspace close to transportation to assist those who are disabled and created an environment that promotes accessible technology and facilities for those who are neurodiverse. As of 2022, we have committed to focusing on employees' wellbeing by providing mental health resources, growth, and learning opportunities and implementing training to continue to build an inclusive culture. We have focused on accessibility by creating guidelines and support with accessing adjustments, whether those are neurodiversity or physical adjustments. We have clear support mechanisms in place to ensure all employees have equal opportunities. We pride ourselves in having a wide range of employment and training opportunities, providing current and future talent within industries with known skill shortages or high growth. This range starts with Computer Vision Research Engineers to Threat Intelligence Analysts to Software Engineers and Product Managers, giving variety to the diverse skills that we have. By doing this, we are actively tackling inequality in employment, skills, and pay in the workforce, not only by providing opportunities but the ability to grow and develop. We utilise our apprenticeship levy funding across the company to provide all employees with opportunities to gain recognised qualifications to advance their careers. We have invested in a learning platform that gives all employees the opportunity to develop new skills and build expertise in areas that they excel in or in new areas (if this is what they choose to do). Alongside this, we have actively benchmarked all roles within the company to ensure pay fairness for all, regardless of gender.

Wellbeing

We have an established Diversity, Inclusion, and Belonging committee and one of our main focuses for 2024 is how we promote mental wellbeing at work and healthy work-life balance. We are doing this via several initiatives such as measuring workload quarterly via engagement surveys, putting in place guidance on mental wellbeing at work, and bringing in external expert speakers on wellness. Our goal is to ensure all employees have access to proper mental health support by giving them on demand care and resources to allow them to put their wellbeing first. We acknowledge that DEI is an area that we will continue to grow into, but we are proud of the impacts we have made and will continue to make.

Pricing

Price
£0.08 to £2.00 a transaction
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
Free trial services include 250 transactions, available for 4 weeks.

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@iproov.com. Tell them what format you need. It will help if you say what assistive technology you use.