Trust Center

Assess identity, authorization, signing keys, verification and evidence against published scope.

Browse records Security architecture

ON THIS PAGE

TRUST LAYERS

Identity → Authorization → Signature → Verification → Evidence

Reference architecture

ISMS

Organizational governance and certificate scope

VNeID / OpenID

Identity and federated authentication

FIDO2 / Trusted SIC

Authentication and authorization • module scope

CA / RSSP

Certificate and infrastructure-scoped signing

Verification and evidence

Transaction outcomes • not organizational certification

TRUST CENTER

Scope-first, evidence-first.

SECURITY

Security Architecture

Where identity, Agent, provider and key boundaries live.

Security →

VALIDATION

Signature Verification

Certificate, chain, status and time.

Verification →

EVIDENCE

Evidence Architecture

Transaction context that survives beyond signing.

Evidence →

TRUST & ASSURANCE CENTER

Trust is split into evidence-bearing layers

An enterprise reviewer needs to see which evidence belongs to organizational governance, which belongs to authentication/cryptographic modules, and which belongs to an individual signing transaction.

ISMS & Governance

ISO/IEC 27001 anchors information-security governance, risk, audit and improvement within the certificate scope.

Identity & Authentication

VNeID, OpenID and FIDO2 answer different identity/authentication questions.

Authorization

Consent, Passkey and Trusted SIC relate to how user intent/approval is established for a transaction.

Signature

CA/RSSP/QSCD/HSM form the applicable signature-creation layer.

Verification

Validation examines integrity, certificate/status and trusted time under an applicable policy.

Evidence

Transaction identifiers, hashes, events, results and audit records create a traceable evidence chain.

No scope extension

Evidence in one layer must not be used as proof for every other layer.

BROWSE

Explore detailed guidance

Choose a topic to review implementation details.

Policy CenterA unified entry point for policies, privacy and usage rules relevant to Mobile-ID Sign.Security Assurance StackOrganizational, identity, authentication, authorization, cryptographic and transaction-evidence assurance layers.Certifications & ScopeAssess certifications against the subject, module, standard and applicable scope.FIDO2 & Certification ScopeMatch each certification to its named module, platform, date and scope; assess the signing deployment separately.ISO/IEC 27001:2022 — ISMS ScopeISO/IEC 27001:2022 certificate SIS351224I008 scope, evidence and applicability boundaries for Mobile-ID Sign.OpenID CertificationPresent Mobile-ID OpenID certification with exact subject/scope and link it to the identity architecture.Public Claims RegisterMaterial claims carry publication status, scope and canonical evidence/context.Consent & AuthorizationConsent is described by purpose/scope/transaction and remains separate from authentication; the site does not invent legal bases or retention periods without sources.Evidence ArchitectureFrom transaction ID and document hash to signature, certificate, validation result and audit timeline.Legal & Regulatory Mapping — VietnamMap current official instruments for electronic transactions, trust services and personal data to capabilities/evidence without replacing legal advice.Personal Data ProtectionEntry point to official policy, processing purposes, consent, data-subject rights, retention and contact.Public Trust RegisterStructured registry for certifications, evidence and claims suitable for public publication.Responsible DisclosureChannel and principles for reporting security issues; no response SLA is published without approval.Security ArchitectureKey, authentication, authorization, provider and audit boundaries are made explicit.Security ControlsSecurity control domains are organized by source/scope, not as a copy of ISO Annex A.Service PoliciesCentral hub for Privacy, personal-data protection, Terms, consent, security reporting and policy versioning.Threat Model & Control MappingDefensive model for document substitution, replay, sessions, Agent, webhooks, providers and evidence; no exploitation guidance.Signature VerificationValidate signature, certificate, chain, status and timestamp where applicable.

REFERENCE

Assurance framework for service assessment

Vendor assessment

Issuer: SIS / OpenID Foundation / FIDO Alliance / NIST
Record: Certificate number, subject, scope and validity
Source: Certificate / issuer registry

Review supporting record

Architecture assessment

Enterprise: Source record, authority and acceptance
Mobile-ID: Agent / API / orchestration and evidence
External services: VNeID / RAR, CA / RSSP and Trusted Billing

Review supporting record

Operational assessment

Monitoring: Transaction references, state and exceptions
Access: Grant, review and revoke access
Recovery: Incident response, support and reconciliation

Review supporting record

CERTIFIED

Applies only to the certificate scope and source.

VERIFIED

Requires matching verification evidence.

PUBLICLY DOCUMENTED

Public source; not proof of a specific deployment.

PRODUCTION

Requires confirmed contract and environment.

REFERENCE

A model for assessment and integration design.

CONCEPTUAL

A proposed design, not a deployed system.

SIMULATED

Offline data and results.

Trust Center

Identity → Authorization → Signature → Verification → Evidence

Scope-first, evidence-first.

Security Architecture

Signature Verification

Evidence Architecture

Trust is split into evidence-bearing layers

ISMS & Governance

Identity & Authentication

Authorization

Signature

Verification

Evidence

Explore detailed guidance

Assurance framework for service assessment

Vendor assessment

Architecture assessment

Operational assessment

Related content