Skip to content

Compliance Frameworks

BaseID supports 7 compliance frameworks covering digital identity regulations across North America, Europe, Asia-Pacific, Africa, and the UK.

FrameworkRegionRegulatorKey focus
PCTFCanadaDIACCIdentity assurance (Level 1-3), consent, bilingual EN/FR, audit trails
eIDAS 2.0EUEuropean CommissionEUDI Wallets, PID, QEAA, Level of Assurance, mandatory by Dec 2026
HAIPGlobalOpenID FoundationHigh Assurance Interoperability Profile for OpenID4VC — format + algorithm constraints
NIST 800-63USNISTIdentity Assurance Levels (IAL1-3), Authentication Assurance Levels (AAL1-3)
TDIFAustraliaDTATrusted Digital Identity Framework, Identity Proofing (IP1-3), accreditation
MOSIPAfrica/AsiaMOSIP FoundationOpen-source identity platform, offline QR, low-connectivity, 9+ country deployments
DIATFUKDSITDigital Identity and Attributes Trust Framework, 5 service roles, ISO 17065 certification

All frameworks define assurance levels that map to each other:

LevelPCTFeIDASNISTTDIFDIATFMeaning
LowLevel 1LowIAL1IP1LowSelf-declared identity. Minimal verification.
SubstantialLevel 2SubstantialIAL2IP2MediumGovernment-issued ID verified. Database checks.
HighLevel 3HighIAL3IP3HighIn-person or biometric verification. Highest confidence.
LevelTypical evidenceVerification method
LowEmail, phone, self-declared namePossession check (email link, SMS code)
SubstantialGovernment photo IDRemote document verification, database check
HighGovernment photo ID + biometricsIn-person proofing, biometric match, supervised video

Canada’s framework for digital identity, published by DIACC.

  • Identity Assurance: Levels 1-3 aligned with evidence strength
  • Consent Management: Explicit consent lifecycle — record, query, revoke
  • Audit Trail: Tamper-evident hash-chained logs
  • Bilingual: All outputs available in English and French
  • Privacy: Data minimization principles
  • baseid-pctf crate: AssuranceLevelEvaluator, ConsentManager, AuditLog, PctfValidator, ReportBuilder (58 tests)
  • Cloud API: GET /v1/compliance/report?framework=pctf

The EU regulation mandating EUDI Wallets for all member states by December 2026.

  • PID (Person Identification Data): Mandatory attributes — family_name, given_name, birth_date
  • QEAA: Qualified Electronic Attestation of Attributes
  • Level of Assurance: Low, Substantial, High
  • Trust Lists: Trusted issuer registries per member state
  • Formats: SD-JWT VC and mso_mdoc (via HAIP)
  • baseid-eidas crate: EuPid, LoaMapping, QeaaValidator, TrustList (14 tests)
  • Cloud API: GET /v1/compliance/report?framework=eidas

HAIP (High Assurance Interoperability Profile)

Section titled “HAIP (High Assurance Interoperability Profile)”

OpenID Foundation’s profile constraining OID4VCI/VP for high-assurance use cases.

ParameterAllowed values
Credential formatsdc+sd-jwt (SD-JWT VC), mso_mdoc (mDL)
Signing algorithmsES256, ES384, ES512, EdDSA
Client ID schemesx509_san_dns, x509_san_uri, verifier_attestation
Response modesdirect_post
Proof typesjwt
  • baseid-haip crate: HaipProfile::v1(), format/algorithm/scheme validators (12 tests)
  • Cloud API: POST /v1/compliance/haip/validate

US federal standard for digital identity proofing and authentication.

LevelIdentity proofingAuthentication
IAL1Self-assertedAAL1 — single factor
IAL2Remote or in-person with evidenceAAL2 — multi-factor
IAL3In-person with biometricsAAL3 — hardware-bound MFA

MOSIP (Modular Open Source Identity Platform)

Section titled “MOSIP (Modular Open Source Identity Platform)”

Open-source identity platform deployed in 9+ countries across Africa and Asia.

  • Offline QR: Credential verification without internet
  • Low connectivity: Designed for limited network environments
  • Biometric binding: Optional face data in credentials
  • Data sovereignty: Country-hosted deployments
  • baseid-mosip crate: OfflineCredential, QR encode/decode, verify_offline (16 tests)