Digidentity

eHerkenning is similar to DigiD. Just like citizens can use DigiD to login with the government agencies, companies, entrepreneurs and professionals can do that with eHerkenning.

An eHerkenning tool is person-bound. It cannot be transferred to someone else, such as a colleague. As user of eHerkenning, you can be authorised by your supervisor to act on behalf of your company with your service providers. 1 or more authorisations are registered when applying for a tool.

€0.75

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

€9 ex VAT per year

Request EH1

€1.75

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

€21 ex VAT per year

Request EH2+

€3.00

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

With BSN check on Dutch ID document

€36 ex VAT per year

Request EH3 / Id3

€6.00

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

One time cost €17.50 for the face-2-face check

€72 ex VAT per year

Request EH3

€6.00

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

One time cost €17.50 for the face-2-face check

€72 ex VAT per year

Request EH4

Signatures on contracts, employment agreements, purchase agreements, leases, living wills, tenders, policies, building plans and other documents no longer need to be entered on paper. These documents can be attested by a digital signature.

By means of eSGNG by Digidentity, it is possible to sign PDF documents digitally in a legally valid way. To do so, you can use our eSGNG app, or you can integrate the functionality into your own workflow.

Benefits

Ease: The signatory can conduct his or her business fully digitally at any location and at any time. The signatory can simply sign on his or her mobile phone, laptop or desktop computer, or tablet. eSGNG allows for multiple signatories.
Cost savings: Thanks to the digital signature, there will be no unnecessary costs for paper, administrative acts and mail.
Time saving: Reduce operational costs and put an end to manual processes. This way, you will no longer need to send prompts or follow-up by phone: If a signatory still lingers over your contract, you can send them a fast reminder through eSGNG. This will save you time and bother.
Safe: We fully comply with the latest security standards.
Legal validity: The qualified digital signature is 100% legally valid and complies with the electronic signature requirements in conformity with eIDAS and article 3:15a of the Dutch Civil Code.
Environmentally friendly: No paper, no mail.

What is an electronic or digital signature?

An electronic or digital signature is an electronic equivalent of a hand-written signature. An electronic signature consists of electronic data that are attached to a digital document.

The purpose of an electronic or digital signature is to establish:

the identity of the sender (authenticity and identification) and
the invariability of the information sent (integrity).

The eSGNG app

You can download the eSGNG app on a tablet from the app store (and soon, it will also become available as a web application). Once you have signed in with your Digidentity account, you can start using eSGNG right away.

Integrating digital signatures into the workflow

Alternatively, you can choose to integrate digital signatures into the existing workflow of your company or organisation. Send, sign and share immediately from the applications that you are already using.

We provide a user-friendly integration of digital signatures into your own application. This may be a portal, a mobile app, document management system (DMS) or any other application in which documents need to be signed in a straightforward and legally valid way.

So:

No separate application, but entering digital signatures directly from the trusted custom applications
Signing larges volumes

Interested? Contact us for more information.

Legal validity

According to European and Dutch legislation, there are three types of electronic signatures:

The ordinary electronic signature (which we call Basic) You can use an ordinary electronic signature to sign your insurance policy. Along with the fact that you pay the premium and that the insurer has your address details, this type offers sufficient reliability (and is thus legally valid).
The advanced electronic signature (which we call Advanced) An advanced electronic signature is connected to the signatory in a unique way and enables identification of the signatory. This type of signature involves extra checks to verify that the signatory is the right person. This signature is used, for instance, for filing your tax return.
The qualified electronic signature (which we call Qualified) A qualified electronic signature is a signature with a qualified certificate. Such a certificate is a digital file that has been attached to the original document. There are special authorities that issue these certificates, the so-called Trusted Service Providers (TSP’s) or certification service providers. Like Digidentity, for example. The Dutch government makes use of a certificate that is issued by Public Key Infrastructure (PKI)-Overheid. Agentschap Telecom monitors the certification service providers. Issuing this type of signature even involves a visual check (face to face) to verify that the person concern is who he/she says he/she is.

Out of the various types of electronic signatures, only the qualified electronic signature is legally equated with the hand-written signature under European law. Parties that claim that the signature is false will need to prove this themselves. This does not apply to the other types of electronic signatures: in case of a legal conflict, the signatory himself will need to prove that the signature is legally valid.

eIDAS and the dutch civil code

In 2016, a new European regulation came into force, officially named Regulation (EU) No. 910/2014 of the European Parliament and of the Council, of 23 July 2014, on electronic identification and trust services in the internal market and repealing Directive 1999/93/EC. Quite a mouth full, and in practice the new regulation is referred to as eIDAS. This complex act regulates a vast number of things, but among others, it aligns the use and the value of electronic signatures throughout the European Union. You can read more about eIDAS here

As a result of eIDAS, the Dutch Civil Code has been amended.

eIDAS

This arrangement is known as the eIDAS Regulation. eIDAS is the acronym for ‘Electronic Identification and Trust Services (for electronic transactions in the Internal Market)’, referring to the eIDAS Regulation no. 910/2014 of the European Parliament.

European member states have agreed to use the same concepts, arrangements and infrastructure with regard to access to online services. This ensures that the levels of reliability of the login schemes used within the European Union are aligned. The various arrangements have been enshrined in the eIDAS Regulation.

This regulation promotes cross-border services and trade between citizens and businesses in the European member states.

The eIDAS Regulation became effective on 17 September 2014. As from September 2018, the mutual recognition of notified member state eIDs is mandatory.

Digital services

eIDAS renders digital services accessible to Europeans residing in the Netherlands. Expats, foreign students and seasonal workers do not need to apply for a Dutch DigiD, but can log in using their own eID instead, for instance to apply for a parking permit or to inform their municipality they have moved.

National login schemes or eIDs

In the Netherlands, we use DigiD, eHerkenning or Idensys. The Fins use a Mobiilivarmenne or FINeID; in Denmark, one can log in using a NemID; and in Spain, citizens use a Documento Nacional de Identidad electrónico (DNIe).

Incoming and outgoing traffic

The regulation consists of two parts, i.e. incoming and outgoing traffic.

Incoming traffic

European citizens using their national login scheme to log in to Dutch service providers. For instance, expats can already log in to the portal of the municipality of Wassenaar by means of their own national login ID in order to access their personal data. This section of the regulation is mandatory for Dutch public organisation.

Outgoing traffic

Dutch citizens logging in to service providers elsewhere in Europe using a notified login scheme (recognised by Europe). This part of the regulation is not mandatory However, DigiD, eHerkenning and Idensys intend to have their login schemes notified. This will render them suitable for logging in to all European government services.

Regulation concerns the entire public sector

Since all member states must implement the mandatory section of the regulation, so – obviously – must the Netherlands. The public sector is at the forefront of this development, as the European measure is binding for all public organisations (i.e. those offering digital services involving online authentication and accepting login schemes with 'substantial' and 'high' levels of reliability). Apart from this, private organisations performing public tasks likewise need to comply with the regulation. Thus, the regulation concerns ministries, implementing organisations such as RDW and UWV, municipalities, provinces, district water boards, but also private independent administrative bodies (ZBOs), academic hospitals and pension funds.

On 25 July 2017, the Dutch Ministry of Economic Affairs issued an administrative letter on eIDAS (only Dutch). This letter informs 808 public organisations and private organisations performing a public duty regarding the eIDAS regulation. If your organisation received this letter, you are obliged to comply with this European regulation.

What does your organisation need to do to comply with the obligation?

In the Netherlands, you can comply with the eIDAS obligation for online access through the eHerkenning | Idensys system. This means that by connecting to an eHerkenning | Idensys broker you will comply with the obligation to grant EU citizens online access to your service. As accredited brokers, we are able to arrange this connection for you.

Are you already connected to eHerkenning | Idensys? Then you are part-way to complying with the measure.

Are you participating in DigiD? In that case, we can arrange a connection to eHerkenning | Idensys for you.

Please contact us to find out which steps you need to take.

What is the advantage of the eIDAS regulation for my organisation?

Prior to the eIDAS regulation, your customer service was tasked with the administrative processing of European citizens, consumers and company representatives. These administrative processes were often long-winded and complex compared to the digital services that were already being provided for Dutch citizens, consumers and company representatives. Thanks to the eIDAS regulation, public services providers will be able to render services to European citizens, consumers and company representatives more easily and more cheaply.

Trust services

The European Union's eIDAS legislation goes beyond electronic identification.

Trust services are electronic services, usually provided for remuneration, which comprise the following:

creating, verifying and validating electronic signatures, electronic seals or electronic time stamps, services for electronic registered delivery and certificates related to those services; or
creating, verifying and validating certificates for website authentication; or
preserving electronic signatures, seals or certificates related to those services (article 3, under 16, eIDAS Regulation).

Trust services are understood to mean:

electronic signatures (also called digital signature, e-signature or e-sign);
electronic seals;
electronic time stamps;
services for registered delivery;
electronic certificates for website authentication.

With regard to trust services, a distinction is made between qualified and non-qualified services. In principle, a non-qualified supplier is any supplier offering such a service. A qualified provider is a provider that offers services with a higher level of reliability.

The change that probably impacts on the providers of such services most is the new notification requirement and duty of care. As from 1 July 2016, providers of both qualified and non-qualified trust services are to report incidents with a significant impact to the supervisory body (the Authority for Consumers and Markets – the ACM) and, where appropriate, also to the Dutch Data Protection Authority (AP) and the National Cyber Security Centre (NCSC). Moreover, there are enhanced supervision and security requirements. For instance, qualified trust service providers are to carry out annual security audits and submit their results to the supervisory body.

Are you a trust service provider and do you want to find out what this means to your organisation and which measures you need to take? Please contact us. We are happy to help you!

Certified Trusted Service Provider

Digidentity is a certified Trusted Service Provider (TSP). As objective organisation, we provide commercial reliability with digital transactions. We do this with commercial and technical security services.

A TSP has technical and legally reliable resources for performing and facilitating electronic transactions, and for producing objective evidence in case of disputes.

Periodic audits

As neutral facilitator, it is important to us to control our processes. To guarantee this control, Digidentity is periodically audited according to the norms of ETSI EN 319 411-1, ETSI EN 319 411-2 and ISO 27001:2013.

For more information, read the general terms and conditions of Digidentity and the Certificate Practice Statements of PKIgovernment.

Highest safety standards

We comply with the strictest safety standards and are authorised to provide digital identities. The information that we send via the internet is secured on a very high level.

We are thus not only a Trusted Service Provider, but also a Certification Authority and hold a PKIgovernment certificate. Our organisation, systems and employees are periodically audited and found acceptable by BSI. This happens conform the CWA requirements.

Our certifications

BSI - ISO/IEC 27001:2013

Delivery of Identity Services, Digital Signing and Certificate Services by the processes Registration, Dessimination, Authorisation, Broker and Revocation Service, IT Operations and Development.

BSIGroup.com Certificate ISC 066

BSI - ETSI EN 319 411-1

Trust Service Providers issuing certificates; Part 1: General requirements

Providing Certification Authority processes and services under the Staat der Nederlanden Root CA-G2, the Staat der Nederlanden Organisatie CA-G2 and the Staat der Nederlanden Burger CA-G2.

BSIGroup.com Certificate ETS 043

BSI - ETSI EN 319 411-2

Trust Service Providers issuing certificates; Part 2: Requirements for Trust Service Providers issuing EU qualified certificates

Providing Certification Authority processes and services under the Staat der Nederlanden Root CA-G2, the Staat der Nederlanden Organisatie CA-G2 and the Staat der Nederlanden Burger CA-G2.

BSIGroup.com Certificate ETS 015

PKIgovernment

Public Key Infrastructure for the government, in short PKIgovernment, enable reliable communication. PKI certificates secure the information that persons and organisations send via internet on a high level of reliability.

Logius.nl

eHerkenning

We are officially recognised by the eHerkenning administration organisation, part of the minister of Economic Affairs, as eHerkenning broker. This means that we can offer services and solutions for the total playing field of eHerkenning, the successor of DigiD for companies.

eHerkenning.nl

Idensys

Login safely on the internet. This is very important when doing business with the municipality, the Tax department or a health care insurer online. This is also important when you shop or bank online. The government and enterprises thus work together to safely login on the internet. The new way of logging in is called Idensys.

idensys.nl

tScheme

tScheme is the independent, industry-led, self-regulating system set up to create strict assessment criteria based on which the Trust Services will be approved.

tScheme.org

1. About us

Digidentity BV is a registered company in the Netherlands, with company number 27322631, situated at Waldorpstraat 17 P (2521 CA) in The Hague.
Questions about the identity service can be resolved via the website (www.digidentity.co.uk) or by contacting the service desk via phone (+44‐33‐06060732) or e‐mail (helpdesk@digidentity.co.uk).

2. Contract and Scope of Application

You agree to these terms and conditions by applying for an identity account via Digidentity. The terms and conditions will continue to apply whether or not the verification of your identity is successful or not.
Excluding any other terms and conditions, the present terms and conditions will apply to all aspects of the relationship and the contract between you and Digidentity, unless otherwise expressly agreed to in writing from Digidentity. Unconditional acceptance and agreement of these terms and conditions is implied.
Digidentity reserves the right to unilaterally modify the terms and conditions at all times. The modified terms and conditions will apply immediately after being published on the website. You will be informed of any changes via notifications on the website and/or by notifications in your identity account.
In the event that you are not in agreement with any modified or revised Digidentity terms and conditions, then you are able to withdraw from using the service via your identity account. In your identity account you have the possibility to deactivate your identity account.

3. Identity Service

On applying for an identity account the process of verification will begin immediately, including the validation of documents and data provided by you and by other sources. If the completed verification process results in a confirmation and/or validation the fully verified identity account will be provided. The decision to grant an identity account remains exclusively with Digidentity at all times.
On granting an identity account the necessary user name, password and other modes of access will be provided. The log in details are strictly personal and confidential. Sharing this information with any other person or entity is not permitted, you must take all reasonable measures to prevent the abuse, misuse, theft, or loss thereof.
Documentation and information provided for the verification of identity will be stored by Digidentity in accordance with appropriate data protection laws as set out in the privacy policy. After issuing a fully verified identity account, and providing the means to access personal identity accounts, it will be necessary to re‐validate your existing information/data via the relevant issuing authorities from time to time. This is necessary in order to ensure that Digidentity have the most up‐to‐date details available for the purposes of identity verification.
Verified identity accounts (fully verified or not) are valid for a period of one year. After one year the account will be deactivated automatically and will require reactivation by you. A notification to reactivate an account will be visible the first time trying to log in after one year has elapsed.

4. Termination

You may deactivate identity accounts at any time by using the "deactivation" button in the identity account. A 3 hour 'cool off' period is required, as set out in our privacy policy. If you wish to reactivate an account, you can log back in within 3 hour after requesting deactivation. After 3 hour have elapsed, with no reactivation by you, the account will be rendered inaccessible and will be no longer be available to use. Relevant records will be kept for the purposes of auditing, in accordance with appropriate laws.
Digidentity reserves the right to deactivate accounts with immediate effect if there is any reason to believe or to suspect that the verification and/or validation provided has been faulty or is no longer correct. In order to gain access to an identity account again you will be required to apply for a new identity account.
Digidentity reserves the right to deactivate accounts with immediate effect if communications from you to Digidentity employees are considered harassing, threatening, abusive and beyond the provision of reasonable services offered to support applications for identity verification. Any continuation of abusive, threatening or harassing behaviour will be reported to the appropriate authorities.
Digidentity reserves the right to deactivate accounts with immediate effect if it is suspected or known that the information provided during identity verification is false/fraudulent as set out in the privacy policy. Any fraudulent activity will be referred to the relevant authorities. On behalf of the Identity service, the Government Digital Service may also report any suspicious activities to any relevant body or appropriate.

5. Our Obligations

Digidentity will provide the identity service as described on the website in accordance with the terms and conditions, the associated privacy policy and Good Industry Practice. In the provision of identity verification Digidentity will act diligently and with reasonable care. Digidentity will carry out any contractual obligations involving efforts in verification processes, however, you cannot derive any rights from these obligations in order to guarantee a successful outcome in your application for an identity account.
Digidentity aims to provide a continuously functioning and accessible identity service, but makes no guarantees about the availability of any services provided. You accept the fact that errors (temporary) may occur which would render the service inaccessible on some occasions.
Digidentity reserves the right to limit access to, or render the identity service entirely inaccessible for limited periods of time in order to carry out maintenance and/or implementation of required modifications. Digidentity aims to carry out these scheduled 'down times' in periods which could be reasonably determined to affect the minimum number of users as far as possible e.g. outside of office hours.
Digidentity will provide the service in accordance with the published Digidentity Privacy Policy. This Privacy Policy is accessible from the service and will be updated from time to time to reflect changes in the processing of data in relation to the service.

6. Your Obligations

You agree to supply the necessary and required information and documentation in order to apply for the verification of identity. This includes a variety of personal information, and may or may not include passport, driving licence, a live bank transaction for £0.00 and knowledge based questions. You agree that in consenting to these terms and conditions that your consent is given to the extraction of data from your credit file in order that the knowledge based questions can be generated.
You agree and understand that verification of identity is a process reliant on personal details, available documentation and information provided by you, and is uniquely based on your own details. You accept that their identity verification process cannot be based on that of other user experiences or requirements.
You agree to ensure and guarantee that all data, documentation and information provided is correct, complete, accurate and up‐to‐date and conforms to the requirements as set out by Digidentity during the process of identity verification. You agree to notify Digidentity of any changes to your registration information. You agree to follow instructions and requirements for any transfer of data (via the online process, or using the mobile/tablet application) as indicated by Digidentity.
You accept and agree to inform Digidentity immediately if there are any security concerns, security issues or data leaks. Any report of this information to Digidentity will be treated as strictly confidential, and handled in accordance with appropriate laws and regulations in order to minimise damage to the affected users, to Digidentity or 3rd parties. Digidentity aims to resolve any security alerts or hazards as fast as reasonably possible and will take steps to inform any 3rd parties affected.
You accept the obligation to inform Digidentity of any violation of the terms described in articles 6, 8 and 9 accompanied by a detailed description of such violation and all other relevant information. You must take all reasonable measures to prevent further and/or continuing violations and shall take all reasonable measures to limit any damage resulting from such a violation.

7. Reasonable Use of Website and associated materials

You are prohibited from copying, passing on, selling, publishing or making profit from any content of the website, products, services or associated materials of Digidentity
You are prohibited from using the website, products or associated materials of Digidentity in any way that causes, or may cause, damage to the website or impairment of the performance, availability or accessibility of the website, products or associated materials.
You are prohibited from accessing the website and associated materials of Digidentity using any robot, spider or other automated means.

8. Personal Data

You acknowledge that the identity service is an authentication service and agree that Digidentity will use data to undertake a search for the purposes of verifying identity or the validity of any data or documents. In order to do this Digidentity may compare and check data against available databases (public or otherwise) which are accessible for the purpose. A record of the search will be saved for 7 years, as indicated in the privacy policy and in accordance with the requirements of appropriate laws and record keeping.
By entering into the contract you agree that personal data will be processed according to the Dutch personal data protection act, and in accordance with The Data Protection Act 1998 (UK). The data protection acts refers to the law regarding the protection and processing of personal data.
Digidentity and any relying parties' process information according to the laws specified in clause 8.2. Digidentity remains the responsible party for the processing of personal data at all times, whether using relying parties or not, in accordance with the Dutch Personal Data Protection Act and The Data Protection Act 1998 (UK) as a Data Controller.

9. Confidentiality

Digidentity and you are obliged to take all reasonable measures to protect confidential information or the identity account from unauthorised access, loss, damage, modification or unauthorised processing. In the event that this occurs Digidentity must be informed immediately of any such unauthorised access, loss, damage, modification or unauthorised processing

10. Rights of Ownership and Intellectual Property

Any intellectual property rights associated with the identity service or associated materials remain at all times the property of Digidentity, the licensee or our supplier.
The right to use the identity service or associated materials related to the identity service does not imply any transfer of any intellectual property rights of the identity service or associated materials to you. Digidentity only provides a non‐exclusive right to use the identity service and/or associated materials for the purpose of identity verification and creating an account. The rights of your use is strictly personal and cannot be transferred to any other person.
You are prohibited from using the identity service, data or associated materials in any way, or by use of any part, that would result in the violation of intellectual property rights of Digidentity, the licensee or suppliers.
Digidentity reserves the right to take all measures necessary in order to protect intellectual property rights owned by them, the licensee or suppliers. These measures include the termination of the use of the identity service or associated materials upon the termination of the contract. You are prohibited from removing or circumventing any such measures in any way

11. Liabilities

Nothing in these Terms and Conditions excludes or limits our liability in respect of a) Any breach of law by Digidentity or its sub-contractors, b) any loss, unauthorised access to or corruption of Personal Data held by Digidentity or its sub-contractors (including any credentials issued to you), c) any wilful default on the part of Digidentity or its sub-contractors. Any other limitations on liability included in these Ts&Cs must be reasonable in all the circumstances of the services provided by Digidentity to the user.
We are not responsible to you for any loss or damage suffered by you which was not an obvious consequence of us breaching these Terms and Conditions. We are not responsible to you for losses which you suffer due to any events beyond our reasonable control. We are not responsible to you for losses which you suffer which are not directly caused by our actions.
Digidentity cannot be held liable for damages resulting from events beyond reasonable control or not caused directly by actions by Digidentity.
Digidentity cannot be held liable for any indirect damages or damages caused because you did not/or do not take appropriate measures to i) limit such damages immediately after a damaging event has occurred, ii) prevent further damage or subsequent damages resulting from the initial event, iii) immediately took action to inform Digidentity about events which would cause damages and/or took action to provide relevant information to Digidentity.
In all cases the liability of Digidentity shall be limited to the usual and foreseeable damages. Digidentity can not be held liable for any business damages after using the identity service in the capacity of a consumer.
Digidentity can never be held liable in respect of any damages resulting from
1. Your unauthorised or improper use of the data, the identity service and/or related materials;
2. That the data you have provided is incorrect and/or incomplete, or not provided to Digidentity in a timely manner;
3. Losing your own data;
4. Your failure to abide by any obligations as provided in these terms and conditions, including not cooperating with the terms and conditions.
5. The late, incorrect, or incomplete accessibility of the identity service;
6. a. Miscommunication or loss of messages and notices resulting from the use of a mode of communication selected by you or resulting from the dysfunction of any materials used by you, including improper functioning of the internet;
7. The use of materials selected by you;
8. The unauthorised use, loss or theft of log in details that have been provided to you;
9. The downtime or unavailable online tools of third parties.

12. Limitation of Action

Any claim for damages against Digidentity must be brought within one year after the damage has occurred.

13. Force Majeure

Digidentity are not obliged to perform any of the obligations under the contract or the terms and conditions in case of force majeure. Force majeure is understood to include but is not limited to:, improperly functioning materials provided by users, requirements under the law, power cuts, improper functioning of the internet, or of computer‐ and telecommunication facilities, extreme weather conditions, fire, flooding, war, strike, general problems of transportation and unavailability of one or more of Digidentity employees.

14. Applicable Law and Disputes

The contract and the terms and conditions are governed by Dutch law in adherence and conformity with application European Directives, specifically Article 8 of the European Convention of Human Rights regarding laws on privacy.
Any dispute that cannot be settled amicably will be brought before the competent judge of the place where Digidentity have a statutory seat (The Hague). If applicable Dutch or European law provisions determine that another judge is also competent, then the case may also be brought before this judge. If applicable Dutch or European law provisions determine that another judge has exclusive competence, then the case may only be brought before this judge.

15. Warranties

Digidentity do not provide for any other guarantees, undertakings, and/or commitments than those explicitly provided for in the terms and conditions.

16. Concluding Provision

Should any provision of the terms and conditions be declared invalid or void, this shall not affect the validity of any of the other provisions included in the terms and conditions. In such case Digidentity will amend the terms and conditions with the aim to achieve the same object and purpose served by the provision declared invalid.

Definitions

The following words have the following meaning:

User

"User", "you" or "your" in these Terms and Conditions refer to you as a user of the Identity Service.
Identity service

The service provided by us to you entailing the verification of your identity and/or the validity of any documents or data. If this verification and/or validation process results in a confirmation and/or validation of the information provided by you, an identity account will be created for your personal use.
Relying party

The relevant third party who requires you to verify your identity in order for you to use its services, i.e. Government Departments like rand HMRC.
Contract

The relationship between you and us, governed by the terms and conditions according to article 2.1.
Terms and conditions

These terms and conditions as set out here.
Identity account

Your unique user profile provided to you by us after successful identification and/or validation of data and documents.
Data

Any data you have provided to us or in connection with the Digidentity Service.
Licensee

The holder of a licence for intellectual property rights connected to the identity service.
Materials

Materials shall refer to any software, hardware, websites, database, designs, models, programs, reports, and other identity services and materials put to use by us or the relying party in relation to the identity service.
In writing

For the present terms and conditions, the term "in writing" will refer to any written communication, whether this be by electronic means or by regular postal mail.
Good Industry Practice

At any time, the exercise of that degree of care, skill, diligence, prudence, efficiency, foresight and timeliness which would be reasonably expected at such time from a leading and expert provider of services which are similar to the Digidentity Service, such provider seeking to comply with its obligations in full and complying with applicable laws and with ISO27001 and tScheme accreditations.

Report your findings.

If you find a weak spot in one of our systems, please let us know. We will always seriously consider your notification and will investigate every possible vulnerabilities. In this way we can repair this as quickly as possible. This way, we can work with you to protect our clients and systems.

We ask you

Please e-mail your findings to our Network Operation Centre ;
Do not abuse the problem, by for example
- reading more information than is necessary to prove the leak;
- download, delete or edit data or components of the software system;
Do not use attacks on physical security, social engineering, distributed denial of service, spam or applications of third parties;
Provide adequate information to reproduce the problem so that we can solve it quickly;
Do not share the problem with others until we have stated that the vulnerability has been rectified and that we have agreed with you to make it public.

We promise

To respond to your notification within 3 days. We will give our assessment of the notification and an expected date for a solution;
We will not take any legal steps against you about your notification. If you at least kept to the abovementioned requirements;
We will treat your notification confidential and will not share your personal data with third parties without your consent;
We will inform you about the progress of our rectification of the problem;
We will mention your name as the person who detected the problem in notifications, but only if you want this;
As a token of our appreciation for your help, we would like to offer you a reward. We will make a €100 donation to any of the following charities, according to your choice for every problem with our security that you detect. Choose from CARE , Homeplan , Edukans .

Summary of the Notifications

May 2016

Vulnerabilities found in the 2-factor authentication of the Idensys App and the website during the pilot phase. The website was vulnerable for a brute force attack on the PUK code. The app was vulnerable for cloning of the PKI certificates. This was only possible through jail breaking/rooting and illegal possession of the smartphone. The vulnerabilities have been fixed. Rewards were applicable. Reported by Jaap van Ginkel c.s. (UvA).

April 2016

A vulnerability was found in the website. It was possible to inject (SQL/Java) codes within the web application (sub domain). The vulnerability was fixed quickly. A reward was applicable and this has been paid. Reported by Serge van Haag (VulnerabilityHunt).

October 2015

Reporting a SSL vulnerability (support of protocols that are no longer safe). This was a known vulnerability and it was in the process of being fixed. Even though it was not necessary to pay a reward for this, an amount was paid to 'CARE' charity. Reported by Joost van Hassel.

Digidentity is a certified identity provider for the GOV.UK Verify service, and as such is listed by GOV.UK as a certified company: GOV.UK website.

Via Digidentity:

Users can register for a Digidentity account to assert their identity.
Users with an asserted identity can access services available for GOV.UK Verify.
Users can expect the highest standards of authentication and security available.

To provide this service to users, Digidentity ensures that the requirements and standards of the UK Government in GPG (Good Practice Guide) 44 and GPG 45 are met.

Once a user has successfully verified for an identity account for GOV.UK Verify LoA1 or LoA2, it can be used to access associated LoA1 or LoA2 services provided by the GOV.UK Verify initiative.

How the service works

Registration

Via the GOV.UK pre-registration questions, Digidentity can be chosen as the identity provider. Once chosen, users are automatically directed to the registration process of Digidentity. The registration process will be per the chosen LoA. Users are required to accept the terms and conditions, without accepting these it is not possible to register.

Authentication

When logging into their profile, or when requiring access to GOV.UK Verify services, users are required to make use of the 2-factor authentication. Users can opt for SMS or by using the Digidentity Authenticator app available. Once authenticated users can access services and/or their profile to maintain it.

IPV

Identity proofing and verification is at the core of creating a digital identity. The information required to verify an identity is dependent on the Level of Assurance. The higher the level, the more assurance is required.

Account Maintenance

Users are in control of their own identity account, and can also make changes where needed e.g. change of name because of marriage. Changes are always verified to ensure maximum protection and security, and for fraud prevention.

Registration

Making an account

Once directed to the Digidentity process users are required to make a username, password and to confirm their email address. Once this is complete the user needs to choose their form of 2- factor authentication, e.g. SMS. 2-Factor authentication is always required to secure the account for GOV.UK verify.

Entering personal details

Users are required to enter their personal details, including; name, date of birth, gender (optional) and address. Sometimes name history and/or address history is required. Once this is entered the details are confirmed and used to collect data from a credit file. The data collected is NOT a credit reference, and has NO impact on the credit reference. The data is used to check and verify information for the process of verification, along with data/document checking services provided by the Government.

Identity proofing

Depending on the Level of Assurance users will be required to provide evidence of the identity. Users registering for LoA2 are required to reach a higher level of assurance and will need to supply a combination of evidences which include (but not limited to): UK passport, Non-UK passport, Photo card ID (Government issued), Photo card driving licence, mobile phone contract, bank transaction £0.00 and knowledge based verification (questions generated from the data). Users can also choose to provide their details using our mobile app. Since photos are required of the document, and selfies too, more assurance is attained per document. Users who provide a UK Passport with the app therefore, need only add one more piece of evidence e.g. bank transaction £0.00.

Completion

Once the process of verification is completed the user will be redirected to the service they initially required. To access services of GOV.UK in the future users can use their existing account credentials, and once successfully logged in, will be redirected to the service required.

Revalidation

During the lifespan of the account it is necessary to revalidate details within 180 days of the registration date. Revalidation is a requirement per the Good Practice Guide set out by GOV.UK. Revalidation ensures the integrity of the data within the user account. If the account revalidation occurs users may be asked to take steps to update their information e.g. passport is expired and so add a new one.

Support

Users requiring support during the process are able to contact us:

Email: helpdesk@digidentity.co.uk
Phone: +44(0)330 60 60 732

Monday to Friday 08:00 to 22:00
Saturday and Sunday 08:00 to 17:00

Calls cost no more than calls to geographic numbers (01 or 02) and your telecoms provider must include these calls in inclusive minutes and any discount schemes in the same way.

Digidentity GOV.UK Verify

Your own Digidentity, be verified

Request a Digidentity

Identification

Verification

Use it

Safe, Simple, Secure, Be Verified

Be verified

Easy online

All in 1 ID

Safe access to your online service

We will help you with eHerkenning and Idensys

We will help you with eIDAS

Who is Digidentity?

A team with a mission

Will you strengthen our team?