CSA STAR Level 1
PublishedRead NamoID’s completed CAIQ v4.1 security and privacy answers in the public CSA registry.
Public self-assessment — not an independent audit
Open the public recordCustomer identity + AI authorization
People sign in. Agents stay in scope.
Launch hosted sign-in for your product. Give each AI client a separate, expiring grant for only the resources and actions a user approves.
Preparing for India's DPDP rollout?Explore DPDP-ready controls
NamoID CLI
$ npx @namoidhq/cli init
Detecting your application and installed agents…
✓ NamoID setup ready
Public beta · Test environment
Trust credentials and supported identity capabilities
DPIIT Recognised StartupiStart RajasthanCSA STAR Level 1Digital IndiaDigiLocker Partner OrganizationCAIQ v4 self-assessmentAWS Mumbai · ap-south-1DPDP-readiness controlsMIT-licensed SDKs
PasskeysWebAuthn / FIDO2TOTP MFAEmail one-time codeGoogleGitHubLinkedInFacebookAadhaarTruecallerWhatsAppSMSOpenID Connect discoveryOAuth · PKCE S256RS256 · JWKS rotationSAML SSOSCIM provisioningMCP resource grantsAppend-only audit
Customer Identity · Public beta
Run customer identity. Not just a login box.
Configure sign-in methods and branding, keep Test and Live separate, revoke sessions, manage users, answer privacy requests, and inspect audit events from one console.
When software starts acting
A signed-in user is not a blank cheque for AI.
A user session proves who is present. An AI client still needs its own boundary: one client, one resource, approved actions, a short lifetime, and an independent revocation path.
Person
Session for your application
AI client
Audience-bound grant for exact actions
Built-in operations
Everything around sign-in. Ready to operate.
Authentication methods are the beginning. Recovery, environments, sessions, user lifecycle, privacy requests, notifications, and audit are what keep identity working after launch.
Public betaCustomer Identity
Developer previewMCP Authorization
Separate by construction
One control plane. A boundary for every actor.
Customer users, workforce users, AI clients, and provider connections can share administration and audit infrastructure without sharing identities, credentials, sessions, or lifecycle state.
Trust record
See the proof. Read the limits.
Open the evidence, check what the product supports, and see which audits and certifications NamoID does not hold yet. No hidden qualifiers.
Available to review
Evidence and controls you can inspect today
India DPDP
Controls availableOperate notice, consent records, privacy requests, audit history, and incident evidence from the identity layer.
Supports your implementation — it does not make your business compliant
See the DPDP controlsEU GDPR
Controls mappedPrivacy and security workflows account for data-subject requests and controller–processor responsibilities.
No certification claimed — applicability depends on your processing
Read our privacy approachNot completed
Audits and certifications we do not hold today
ISO/IEC 27001:2022
Not certifiedWe use the standard as a reference while building NamoID’s information-security management program.
No accredited ISO/IEC 27001 certificate today
Review our security postureSOC 2
Not auditedThe Security, Availability, and Confidentiality criteria guide our control program.
No SOC 2 Type I or Type II report today
Review our security postureIndependent security testing
Not completedWe run internal checks across code, APIs, OAuth, dependencies, containers, and configuration.
No independent penetration-test report today
Review our security posture
India ecosystem
NamoID is a DigiLocker Partner Organization.
Build consent-led DigiLocker document flows through the official partner ecosystem. Each production use case still follows DigiLocker approval and configuration.
Partner status does not mean DigiLocker certifies NamoID’s security
Also recognised: DPIIT and iStart Rajasthan recognise the company as a startup. They do not certify the product or its security.
Read the full security record →Status reviewed 30 Aug 2026 · evidence and availability may change
Security you can inspect
Credentials stay sealed. Grants expire. Decisions stay traceable.
NamoID separates user sessions, AI grants, and provider credentials so each can be limited and revoked on its own path. Review the protocols, assessment, infrastructure region, and current certification status behind the claims.
Separate revocation paths
No provider credential in the client
Append-only decision trail
MCP grant · live lifetime
15:00then the client asks again
orders:readaudience-bound
01
The person’s session
Signs a human into your application. Ending it does not silently rewrite an agent’s authority.
subject → application
02
The agent’s grant
Names one client, one resource, and approved actions. It expires and can be revoked on its own.
client × resource × actions
03
The provider credential
Remains sealed inside NamoID. It is used only after policy allows an action and never becomes the agent token.
stored authority ≠ issued grant
Questions, answered
The things teams ask before they switch.
What can we use today?
Customer Identity is available under public-beta terms. MCP Authorization is a developer preview. Workforce Identity and Agent Access are design-partner product directions, not generally available features.
Is NamoID only for companies in India?
No. Customer Identity uses OAuth, OpenID Connect, PKCE, WebAuthn, JWT, and JWKS. India is where the product has additional depth: DPDP-focused workflows, local operating context, and India deployment requirements. SAML belongs to the Workforce Identity direction, which is not generally available yet.
Does NamoID guarantee DPDP compliance?
No product can make an organization compliant on its own. NamoID provides identity controls and evidence for consent, audit, privacy operations, minimization, and retention. Your organization remains responsible for its notices, purposes, policies, and legal obligations.
Do you have ISO 27001 or SOC 2 certification?
Not today. ISO 27001 and SOC 2 inform our control-readiness program, but NamoID does not currently claim ISO 27001 certification or a SOC 2 report. Completed assessments are listed on the Security page.
Can we migrate from another identity provider?
Usually, but the work is broader than changing an issuer. Callback and token-validation configuration can often move cleanly through OAuth and OpenID Connect; users, password hashes, linked identities, claims, and existing sessions need an explicit migration plan before production cutover.
Do we have to use Hosted Auth?
Hosted Auth through redirect or popup is the supported Customer Identity path during public beta. SDKs handle the OAuth and OpenID Connect mechanics, while NamoID hosts credential collection, passkeys, social sign-in, and MFA. A general native authentication API is not currently offered for production use.
How do MCP Authorization and Agent Access differ?
MCP Authorization protects a resource your product exposes to AI clients. Agent Access is the planned inverse: allowing a named agent to use a human-authorized external account through short-lived, policy-bound access without receiving the provider credential.
How long does a first Test integration take?
The first milestone is deliberately small: connect one application, register one exact callback, and complete one Hosted Auth flow in Test. The time depends on your framework and existing authentication setup; the setup assistant and direct engineering support are available if you get stuck.
What support is included during public beta?
Public-beta teams can talk directly with the engineers building NamoID. Use the setup assistant for configuration, join the Slack community for implementation questions, or book an engineering call for architecture and migration decisions.
Start in Test
Put your first sign-in in Test. Keep the boundary when AI arrives.
Connect one application, register one exact callback, and complete Hosted Auth. If your product exposes an MCP server, add a separate grant for the resource, actions, audience, consent, and expiry.
No payment card during public beta Customer Identity · public beta MCP Authorization · developer preview