Conformance
Standards, stated honestly
We separate what is implemented (with evidence), what we are aligned with but nobody has independently checked, what is planned, and what does not apply. We claim nothing in a higher column than we can show.
Identity and credentials
| Standard | Status | How it applies |
|---|---|---|
| W3C DID Core 1.0 | Implemented | Organisation and device identities are DIDs. Their documents list keys as Multikey verification methods. |
| did:web | Implemented | Organisation identities are hosted at trustedanchor.io. Note that did:web is a W3C Community Group draft, not a Recommendation, and it keeps no history of past keys. A signed key-history log is planned (below). |
| did:key | Implemented | Each inspection device’s Ed25519 key. Also a Community Group draft. |
| W3C Verifiable Credentials 2.0 | Implemented | Inspection records are issued as PhytosanitaryInspectionCredential. |
Data Integrity EdDSA, eddsa-jcs-2022 | Implemented | The proof on every credential. Verified independently by the in-browser verifier and the register. A run against the W3C interoperability test suite is planned. Until then we do not claim to have passed it. |
| RFC 8785 JSON Canonicalization | Used | Canonical form before hashing. RFC 8785 is an Informational RFC, so we say we use it, not that we are certified against it. |
| Bitstring Status List 1.0 | Planned | Today a record’s status (sealed or void) and its key’s status come from the register API. |
| SD-JWT VC and did:webvh | In development | Issuance in these formats alongside the current one, for wallet ecosystems such as the EU Digital Identity Wallet. |
| Signed history of identity documents | Planned | An append-only, signed log of every DID document version, so a verifier can confirm which keys were valid when an older record was signed. |
Trade and regulatory frameworks
| Framework | Status | Our position |
|---|---|---|
| UN/CEFACT Transparency Protocol (UNTP), Digital Identity Anchor | Aligned | Registry-anchored company identities follow the same pattern. Mapping inspection records to the UNTP Conformity Credential is planned. |
| UK Electronic Trade Documents Act 2023 | Planned | We intend to publish a self-assessment against the Act’s “reliable system” factors. We make no claim of reliability under the Act until it is published. |
| UNCITRAL MLETR | Aligned, identity layer only | MLETR governs transferable records such as electronic bills of lading. TrustedAnchor does not issue transferable records. It can identify the parties to them. |
| eIDAS 2.0 / EU trust services | Not a qualified provider | TrustedAnchor is not a qualified trust service provider and is not on the EU Trusted List. Its signatures are not qualified electronic signatures or seals. |
| IPPC ePhyto | Not applicable | Phytosanitary certificates are issued by national plant-protection organisations and exchanged through the IPPC hub. TrustedAnchor signs inspection records upstream of a certificate. It does not issue certificates or connect to the hub. |
| GLEIF LEI / vLEI | Planned | Showing an organisation’s LEI alongside its register number is planned. Issuing vLEI credentials would need GLEIF qualification, which we do not hold. |
Identity checks (KYC & KYB)
| Topic | Status | Our position |
|---|---|---|
| Performing KYC / KYB | Not offered | TrustedAnchor does not check identity documents, run liveness checks or screen against sanctions lists. It is not a regulated KYC provider. |
| Reusable check credentials | Planned | An accountable party, such as a bank, a company register or a verification provider, makes the check. TrustedAnchor signs its outcome under that party’s identity, with the method, date and level of the check. The credential says who checked, not just that someone did. |
| Company identity (KYB) | In development | Company identities anchored to UK Companies House, NL KvK and ZA CIPC records. Not yet issuing. |
| Reliance by regulated firms | Your decision | Under FATF Recommendation 17 and national rules (for example the UK Money Laundering Regulations 2017 and South Africa’s FIC Act), a firm that relies on someone else’s check stays responsible for its own due diligence. A TrustedAnchor credential is evidence for that decision, not a substitute for it. |
| Personal data | Planned | Credentials about people will use selective disclosure (SD-JWT VC). The holder shares only the facts asked for, and the register publishes nothing about the person. |
Assurance
No certifications are held today: no ISO/IEC 27001, no SOC 2 and no WebTrust or ETSI audit. When an independent report exists, it will be published here with the certificate number, issuing body, scope and validity dates, so you can check it with the issuer.
This site meets WCAG 2.2 AA as a design goal. An independent accessibility review has not been done.