Built for auditability and readiness
BlockID is designed to help you implement the controls regulated environments expect — with honest, accurate language about what certification requires.
FedRAMP-aligned readiness
Designed to help organizations implement controls commonly expected in FedRAMP environments. BlockID supports FedRAMP readiness; it is not certified and requires independent assessment before formal authorization.
Audit logging
Security and business events are recorded with actor, organization, IP, and details to support monitoring, investigations, and reviews.
Access control
Role-based access control with five roles and strict organization scoping helps enforce least privilege and separation of duties.
Encryption
Transport security (HTTPS/HSTS) plus at-rest encryption options for sensitive material. Production signing keys belong in a KMS/HSM.
Tamper-evident logs
A private, append-only hash chain makes unauthorized changes to the ledger easy to detect during integrity checks.
Data minimization
Verifiable credentials reduce the need to copy and store sensitive personal data across systems, lowering breach exposure.
Credential revocation
A revocation registry lets issuers invalidate credentials immediately, with the change reflected at verification time.
Secure deployment
Hardened defaults, security headers, and deployment guidance support secure, repeatable installations.
Backup & recovery
Documented backup of the database and configuration (including key material) with tested restores is part of the deployment guidance.
Shared responsibility model
Security and compliance are a shared responsibility. BlockID provides software capabilities and guidance; the deploying organization is responsible for its environment, configuration, key management, operational controls, and obtaining any formal authorizations.
BlockID provides
- Software controls (RBAC, audit logs, tamper-evident ledger)
- Secure defaults and hardening guidance
- Documentation for deployment and operations
You are responsible for
- Hosting environment, networking, and OS hardening
- Key management (KMS/HSM), backups, and monitoring
- Independent assessment and formal authorization
BlockID Portal provides a FedRAMP-aligned architecture and is designed to help organizations implement controls commonly expected in FedRAMP environments. It is not FedRAMP certified. Formal authorization requires independent assessment by authorized parties (e.g., a 3PAO) and an authorizing official.