Envoc secures SOC 2 Type II certification for identity platforms

Envoc has completed a SOC 2 Type II certification to strengthen the company’s security credentials as it pursues government and regulated-industry identity projects.

The company specializes in digital identity, biometric verification, mobile driver’s license  (mDL) integration, and privacy-preserving technologies.

Envoc says the independent examination assessed controls relevant to security, availability, processing integrity, confidentiality, and privacy, including how personal and biometric information is collected, processed, stored, and deleted.

The certification considers whether specified organizational and technical controls operated effectively over a defined period.

Envoc identifies encryption, access controls, monitoring, and incident response among the measures associated with its SOC 2 program. The company says the controls apply to FaceLock, QTopia, and its other identity offerings.

The certification can help government agencies and other regulated businesses evaluate if the technology provider has repeatable processes for protecting sensitive biometric data, managing access, and responding to operational risks.

Envoc presents the certification as evidence of its readiness to support identity systems that can affect access to financial accounts, government services, and other high-stakes transactions.

“The SOC 2 Type II certification equips us to serve high-stakes government transactions with even greater confidence, giving residents and users disciplined privacy while countering the rise of AI-driven threats,” says Calvin Fabre, founder and lead innovator of Envoc.

The company also says SOC 2 Type II requirements increasingly appear in state and federal procurement processes. This makes the attestation important for passing vendor-security reviews and competing for government contracts.

The examination supports the bridge between technical capability and procurement eligibility. However, a government customer would still need to evaluate whether FaceLock meets the technical, legal, and operational requirements of the intended use case.

The customer evaluation could include biometric performance testing, presentation attack detection (PAD), privacy analysis, mDL interoperability, NIST requirements, and specific security controls.

Article Topics

certification  |  cybersecurity  |  data protection  |  Envoc