Beyond Identity Compliance & Certifications 2026

Its own credentials start with SOC 2 Type 2, an independent AICPA Trust Services Criteria attestation. Alongside it sit GDPR certification, a FIDO2 certification as a FIDO Alliance member, plus CCPA compliance and a BIPA-aligned design. Other regimes sit one step removed. PCI DSS, PSD2, NYDFS, plus FedRAMP are standards the platform helps customers adhere to rather than authorizations Beyond Identity holds. ISO 27001 is not listed, so confirm any of these directly if your program requires them.

With hardware-bound keys and on-device biometrics. Each Universal Passkey is an asymmetric key pair, and its private key is generated inside the device's hardware trust module and never leaves. Only the public key goes to the cloud. Keys live in a Trusted Execution Environment where one exists: an Apple T2, a TPM on Windows and Linux, the Titan chip on ChromeOS, or an AWS Nitro enclave. Where none exists, OS-level secure storage is the fallback. Biometrics stay on the device and only verify locally, which aligns with BIPA.

Access needs a device-bound passkey plus the ability to verify on that device, and there is no password or one-time code to phish. During login the device signs a unique challenge with its hardware-held private key, and Beyond Identity checks the signature. FIDO2's WebAuthn and CTAP public-key cryptography removes the weaknesses of passwords and OTPs. A fresh challenge every time means an intercepted credential cannot be replayed.

By reading the code and the architecture. The SDKs are open source on GitHub, so the client integration, including how passkeys bind and how the private key is generated into hardware, can be inspected rather than trusted. The device-bound flow is itself auditable, with the public key in the cloud and the private key in the device's TEE. The SOC 2 Type 2 attestation and the FIDO2 certification add independent third-party validation.

Pull the SOC 2 Type 2 report and confirm the FIDO2 certification scope. Treat PCI DSS, PSD2, NYDFS, plus FedRAMP as regimes the platform helps you meet, not certifications it carries. Verify what you actually need, particularly that this is not a FedRAMP authorization. Confirm ISO 27001 directly if you require it, since it is not stated. Check that your device fleet has hardware Trusted Execution Environments so keys avoid the OS fallback. Use the open-source SDKs as the independent check.