Identity
Who or what acts, including people, organizations, services and agents.
Owner: Product and SecurityReview the evidence behind Zoiko iD’s trust architecture.
Explore approved information about identity security, delegated authority, privacy, governance, and assurance. Request additional documentation when access conditions apply.
Three definitions, kept separate
Identity establishes who or what acts. Authority identifies bounded action rights. Evidence records attributable decision context where it is supported. Authentication is not authorization, and a record is not an independent audit opinion.
Authority
The bounded actions an actor may take, within policy-defined limits.
Owner: Product and Security
Evidence
Attributable decision context, where supported and approved for disclosure.
Owner: GRC and SecurityStart with the topic that matters to you
Each topic summarizes approved information and links to the authoritative page that owns it. Topics without an approved destination show as text only.
Compliance & Standards
Standards posture, applicability and assessment status.
Open Compliance Standards →
Responsible disclosure
How to report a suspected vulnerability.
Architecture categories, with their status
Each category is a design area. Claims about implementation appear only when verified and approved.
Authentication
Verifying who is acting.
DesignedDelegated controls
Bounded grants with expiry and revocation.
DesignedMachine and agent security
Sponsors and mandates for non-human principals.
DesignedRevocation
Withdrawal of authority; timing confirmed per integration.
Pending verification
Logging and evidence
Decision context for review, access-controlled.
Designed
Summarized here, governed elsewhere
Privacy architecture is described on the Privacy page. Formal privacy terms, rights routes and jurisdiction-specific statements are owned by Legal and appear in the Privacy Notice only.
- Personal data categories
- Defined in the Privacy Notice
- Legal bases
- Set by Legal, not shown here
- Retention
- Stated only from reviewed records
- Rights requests
- Routed to Privacy operations
Open Privacy →· Privacy Notice route pending approval
Five terms, five different meanings
Practices, standards alignment, certification, independent assessment and reports are different things. Keep them apart when reading any statement.
Security practice
An approach the team follows, described in its own page.
Standards alignment
Design that refers to a standard, without a formal result.
Certification
Issued by a third party, with a scope and validity date.
Report
The document itself, released only when approved.
No certification claim is published on this page. Logos, badges and status labels appear only when backed by a dated, approved source.
Public resources and gated evidence, listed separately
Public material is searchable. Restricted items show only the labels they are cleared to show, and downloads require server-side authorization.
| Title | Type | Scope | Reporting period | Last verified | Visibility | State | Action |
|---|
No published evidence assets are listed yet
Trust topics remain available above. When approved assets are published, each row will show its scope, dates, state and permitted action. No placeholder records are shown.
Talk to an identity expert
Control explanation
Plain-language description of a control.
Policy
Approved organizational policy statement.
Assessment
Results of a review, with scope and date.
Architectural note
Technical description of a design area.
What each asset page will show
Every asset page states its owner, version, timeframe, scope and limitations. Expired or withdrawn material cannot be downloaded, and a successor is linked only when approved.
- Owner and version
- Named, with supersession history
- Timeframe and scope
- Shown only from a verified registry
- Limitations
- Stated next to the asset
- Currentness
- Last verified date and state
- Permitted action
- View, or request, depending on access
Withdrawn: no downloadSuperseded: successor link if approved
A request starts a review, it does not grant access
Submitting a request does not grant permission or guarantee release. Identity, confidentiality and access are checked by the owning team before anything is shared.
Received means your request reached us. It does not mean approved, released or scheduled.
Do not attach confidential documents, credentials or incident details to this form.
- DraftFields are being completed.
- SubmittingRequest is being sent.
- ReceivedServer confirmed. Not approved.
- Under reviewOwner is checking access.
- Needs detailsMore information requested.
- ApprovedReleased through the access service.
- DeclinedNeutral outcome, no detail given.
- ClosedRequest is complete.
Shown only where the owning workflow supports each state.
Overlay-first, with clear ownership
Zoiko iD is designed to complement existing identity providers and applications. Integration status is subject to verification, and no production deployment or geographic isolation is asserted here.
Identity provider
Federated identities for people and services.
Your organizationYour applications
Request decisions and enforce them.
Your organizationZoiko iD authority layer
Scoped authority and policy-decision evidence.
Subject to verificationEvidence owner
Holds the authoritative decision record.
Owning serviceText version
- Your identity provider authenticates people and services.
- Your applications request decisions from the authority layer.
- The authority layer evaluates scope and policy, subject to verification.
- The evidence owner holds the authoritative decision record.
Operational topics belong to their owners
This center does not publish incident reports, vulnerability details, response times or service history. Those live with the teams that own them.
View status
Current operational state, from the status service.
Route pending registry
Security advisories
Published advisories from the owning page.
Route pending registry
Responsible disclosure
How to report a suspected vulnerability privately.
Route pending registry
Frequently asked questions
Find answers to common questions about Zoiko iD
Request assurance information, or talk to an identity expert.
Enterprise reviewers can request assurance information through the route above. Developers and security teams can start with the public pages at any time.
- Public pages stay open
- No gate on education