Mobile-ID · Digital Trust
ISO/IEC 27001 · FIDO2 · OpenID — View scope
Mobile-ID SignGoPaperless Digital Signing
VIGet Started
ASSURANCE ARCHITECTURE

Security Assurance Stack

Organizational, identity, authentication, authorization, cryptographic and transaction-evidence assurance layers.

Browse recordsSecurity architecture
ON THIS PAGE
ASSURANCE STACK

One signing experience, multiple assurance layers

Each layer answers a different risk question. Mobile-ID Sign avoids converting one certificate or identity event into a blanket trust claim.

01

Organizational assurance

ISO/IEC 27001 ISMS

→
02

Identity & authentication

VNeID · OpenID · FIDO2

→
03

Authorization

Consent · Passkey · Trusted SIC

→
04

Signature

CA · RSSP · QSCD/HSM where applicable

→
05

Evidence

Hash · Certificate · status · audit · events

CERTIFICATE TAXONOMY

Use the right evidence for the right question

A CISO should be able to see why a certificate matters and where it stops.

If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.

Use the right evidence for the right question
Certificate / evidenceCertified subject classRelevance to SignBoundary
ISO/IEC 27001Organizational ISMSSecurity governance / risk / auditNot a per-API cryptographic certification
OpenID Certified OPIdentity federation implementationOIDC provider behavior where applicableNot proof of signature creation
FIDO2Authenticator/server moduleStrong passwordless authentication / user verificationPasskey is not a digital signature
FIPS 140-3Cryptographic moduleValidated cryptographic module in its certified configurationDoes not certify the whole application
QSCD / Common CriteriaSignature device/moduleEvaluated signature-device assurance where applicableApplies only to the certified subject
REFERENCE

Assurance framework for service assessment

Vendor assessment

Issuer
SIS / OpenID Foundation / FIDO Alliance / NIST
Record
Certificate number, subject, scope and validity
Source
Certificate / issuer registry
Review supporting record

Architecture assessment

Enterprise
Source record, authority and acceptance
Mobile-ID
Agent / API / orchestration and evidence
External services
VNeID / RAR, CA / RSSP and Trusted Billing
Review supporting record

Operational assessment

Monitoring
Transaction references, state and exceptions
Access
Grant, review and revoke access
Recovery
Incident response, support and reconciliation
Review supporting record
CERTIFIED

Applies only to the certificate scope and source.

VERIFIED

Requires matching verification evidence.

PUBLICLY DOCUMENTED

Public source; not proof of a specific deployment.

PRODUCTION

Requires confirmed contract and environment.

REFERENCE

A model for assessment and integration design.

CONCEPTUAL

A proposed design, not a deployed system.

SIMULATED

Offline data and results.

RELATED

Related content

Choose the next document for your task.

Trust CenterAssess identity, authorization, signing keys, verification and evidence against published scope.Security ArchitectureReview responsibilities and controls for document substitution, replay, spoofing and outages.Certifications & ScopeAssess certifications against the subject, module, standard and applicable scope.Evidence ArchitectureConnect source records, documents, signers, authorization, results and exceptions within a transaction record.
NEXT STEPReview trust records

Search Mobile-ID Sign

Local search inside the offline package.