You're in safe hands

• SOC 2: We undergo an annual SOC2 Type II security assessment by one of the big four accounting firms. We passed our last audit with no exceptions.
• ISO 27001: Our provision of ID Verification Services is certified as compliant with the ISO/IEC 27001:2013 international standard for Information Security.
• Penetration testing: We commission annual penetration testing of our platform and network infrastructure.
• Bounty Program: We participate in the HackerOne community, offering bounty payments to those finding vulnerabilities in our platform.
• Quality Management: In 2023 we attained ISO 9001 certification for our quality management system.

Social, ethical and environmental performance

• B Corp: We have been a certified B Corp since 2015, awarded for our commitment to rigorous standards of social, environmental performance, accountability and transparency. Read our report here.
• Guardian Council: We have our own independent ethics board who are influential individuals from relevant fields such as data privacy and last mile tech. They meet each quarter to discuss issues that affect our users and the people we serve.

Identity Verification

• GPG45: We help clients meet low and medium levels of assurance when checking identity in accordance with the UK government’s Good Practice Guide 45. We’re also happy to assist organisations that need to meet a high level. For more information, read our GPG 45 guidance.

Age Verification

• PAS 1296:2018: As part of our SOC2 assessment, our age-check services were validated as being in compliance with the British Standards Institution’s PAS 1296:2018 code of practice.
• PASS: We have been certified by the Age Check Certification Scheme to provide Electronic Identification Verification Technology (e-IDVT) to issuers of ‘PASS’ (Proof of Age Standards Scheme) cards in the UK.
• FSM: The German Association for Voluntary Self-Regulation of Digital Media service providers has approved our age verification methods to safely regulate access content for minors. Read the report here.

• DPO: Yoti’s Data Protection Officer oversees a Data Inventory that identifies the categories of data that may be stored on the Yoti platform. The inventory also indicates data sensitivity, storage, retention, disclosure, lawful basis for processing and whether certain rights apply.
• GDPR: Yoti products, services and operations are built and run in a jurisdiction subject to the GDPR / UK Data Protection Act 2018, which is implemented through our Privacy Governance Framework. You can request the framework here.
• Product-specific privacy: You can find information in our product-specific privacy policies here

• 5 Rights: We support the 5Rights framework and their mission to create a digital environment fit for children and young people.
• Biometrics Institute: We support the seven ethical principles for building biometric technology, as laid out by the Biometrics Institute.
• Cifas: We are one of 600 members working with Cifas to help reduce instances of fraud and financial crime.

• Data in transit: All public endpoints support only TLS versions 1.2 & 1.3, ensuring that data in transit is secured using up-to-date protocols.
• Data at rest: Data is stored using AES-256-GCM encryption within our production environments.
• Separation of concerns: Our production environments are completely isolated from other company networks, and only members of the Security Operations team are granted access to production systems via a VPN with MFA.

• Data centers: Yoti has two data centers in the UK hosted by Equinix and Telehouse. We have contracted with Amazon Web Services (AWS) to provide cloud computing and hosting services in the UK, Dublin, the US and Canada. 

• Network architecture: The network architecture of the Yoti production systems has been designed with the intention of providing an extremely rigorous level of network security, and to provide redundancy against failure of hardware components, whilst maintaining high performance.

• Monitoring management:Yoti’s Network Operations Centre staff monitor the live production systems 24/7. Monitoring capabilities include systems for real-time cyberthreat/intrusion detection, vulnerabilities scanning, DDoS attack, system performance, resource utilisation and availability. Logging is collected locally in all data centres and archived to Yoti’s central logging infrastructure.

• Multi-layered wrapped key encryption model: Each user’s data in the key-value store is encrypted with a user key that is present only on their own smartphone: it is not stored on the Yoti backend. For further security, there are two more encryption keys stored online and offline locations.
• Attribute storage: Each individual user’s shareable attributes (eg: name, date of birth, passport details) are not stored together as a single record as they are in a traditional database. Instead they are randomly dispersed throughout the partitioned key-value, making it much harder for data to be useful in the event of a breach.
• Single-use tokens: Each individual user’s data items can only be associated with each other via personalised, single-use credential tokens that are stored in the Yoti app on that particular user’s smartphone. Yoti staff cannot access or reconstruct any user’s data themselves: this can only be done with a request made from the user’s own smartphone, that sends a credential token to the Yoti backend database, which is used to assemble the requested data so it can be submitted to a third party.

• This service allows businesses to ask their customers to verify their identity by uploading an image of their ID document and a biometric selfie to our web portal or the embedded solution. Identity attributes are extracted and encrypted in our data centre, where they can only be decrypted by the business making the request. A business can set a ‘time to live’ parameter which determines how long the attributes are stored for in our data centre before being deleted.

• Where we provide online age-checking services to third party websites, this allows users of the website to prove that they are over a threshold age (18+) either by sharing this attribute using the Yoti app, using the identity verification portal or performing an age estimation. The result of the age verification is stored in the users browser session in the form of an anonymous hashed ‘age token’ (a form of cookie).

• User privacy is a key consideration of this service which doesn’t require end users to log in or hold any kind of account with Yoti. They simply present their face to a webcam or camera in a mobile device. The captured image isn’t stored locally but is transmitted securely across the internet using TLS 1.2 encryption to the Age Scan service. The captured image is then deleted and the resulting age attribute (which may simply indicate whether the estimate is over a configured threshold, such as ‘18+’) is securely transmitted back to the client on the capturing device.

• All documents and personally identifiable information stored in the database there are encrypted using AES-256. Passwords and API keys are not stored (only hashes of passwords). Encryption and storage of keys is done on Yoti’s UK data centre infrastructure.

• Login credentials are stored securely in a ‘secure content cloud’ in the Yoti data center and are only downloaded to the browser plugin for the duration of a session. Data in transit between mobile app/browser plugin and the Yoti backend is secured with TLS 1.2 encryption; all data at rest (both in the browser plugin, in the mobile app and on the Yoti backend) is encrypted using AES-256.

• This web portal communicates with Yoti backend services and a database hosted at Yoti’s data centres. Users can submit identity and contact details and receive test results via the Yoti app; alternatively these can respectively be entered manually via a web form and received by email. Data submitted via the frontend webform is not cached locally in the browser and data in transit is encrypted through TLS1.2+.