CSA STAR Level 1
PublishedRead NamoID’s completed CAIQ v4.1 security and privacy answers in the public CSA registry.
Public self-assessment — not an independent audit
Open the public recordCustomer identity + AI authorization
People sign in. Agents stay in scope.
Launch hosted sign-in for your product. Give each AI client a separate, expiring grant for only the resources and actions a user approves.
Preparing for India's DPDP rollout?Explore DPDP-ready controls
NamoID CLI
$ npx @namoidhq/cli init
Detecting your application and installed agents…
✓ NamoID setup ready
Test environment
Trust credentials and supported identity capabilities
DPIIT Recognised StartupiStart RajasthanCSA STAR Level 1Digital IndiaDigiLocker Partner OrganizationCAIQ v4 self-assessmentAWS Mumbai · ap-south-1DPDP-readiness controlsMIT-licensed SDKs
PasskeysWebAuthn / FIDO2TOTP MFAEmail one-time codeGoogleGitHubLinkedInFacebookAadhaarTruecallerWhatsAppSMSOpenID Connect discoveryOAuth · PKCE S256RS256 · JWKS rotationSAML SSOSCIM provisioningMCP resource grantsAppend-only audit
Customer Identity · Available now
Run customer identity. Not just a login box.
Configure sign-in methods and branding, keep Test and Live separate, revoke sessions, manage users, answer privacy requests, and inspect audit events from one console.
When software starts acting
A signed-in user is not a blank cheque for AI.
A user session proves who is present. An AI client still needs its own boundary: one client, one resource, approved actions, a short lifetime, and an independent revocation path.
Person
Session for your application
AI client
Audience-bound grant for exact actions
Built-in operations
Everything around sign-in. Ready to operate.
Authentication methods are the beginning. Recovery, environments, sessions, user lifecycle, privacy requests, notifications, and audit are what keep identity working after launch.
Available nowCustomer Identity
Available nowMCP Authorization
Separate by construction
One control plane. A boundary for every actor.
Customer users, workforce users, AI clients, and provider connections can share administration and audit infrastructure without sharing identities, credentials, sessions, or lifecycle state.
Trust record
See the proof. Read the limits.
Open the evidence, check what the product supports, and see which audits and certifications NamoID does not hold yet. No hidden qualifiers.
Available to review
Evidence and controls you can inspect today
India DPDP
Controls availableOperate notice, consent records, privacy requests, audit history, and incident evidence from the identity layer.
Supports your implementation — it does not make your business compliant
See the DPDP controlsEU GDPR
Controls mappedPrivacy and security workflows account for data-subject requests and controller–processor responsibilities.
No certification claimed — applicability depends on your processing
Read our privacy approachNo certificate yet
Standards we build to, without a certificate yet
ISO/IEC 27001:2022
Aligned · not certifiedBuilt to the ISO 27001 control set.
Documentation on request
Review our security postureSOC 2
Aligned · not auditedControls map to the Security, Availability and Confidentiality criteria.
Documentation on request
Review our security postureIndependent security testing
Internal onlyWe test code, APIs, OAuth flows, dependencies, containers and configuration in-house.
Assessment summary on request
Review our security posture
India ecosystem
NamoID is a DigiLocker Partner Organization.
Build consent-led DigiLocker document flows through the official partner ecosystem. Each production use case still follows DigiLocker approval and configuration.
Partner status does not mean DigiLocker certifies NamoID’s security
Also recognised: DPIIT and iStart Rajasthan recognise the company as a startup. They do not certify the product or its security.
Read the full security record →Status reviewed 30 Aug 2026 · evidence and availability may change
Security you can inspect
Credentials stay sealed. Grants expire. Decisions stay traceable.
NamoID separates user sessions, AI grants, and provider credentials so each can be limited and revoked on its own path. Review the protocols, assessment, infrastructure region, and current certification status behind the claims.
Separate revocation paths
No provider credential in the client
Append-only decision trail
MCP grant · live lifetime
15:00then the client asks again
orders:readaudience-bound
01
The person’s session
Signs a human into your application. Ending it does not silently rewrite an agent’s authority.
subject → application
02
The agent’s grant
Names one client, one resource, and approved actions. It expires and can be revoked on its own.
client × resource × actions
03
The provider credential
Remains sealed inside NamoID. It is used only after policy allows an action and never becomes the agent token.
stored authority ≠ issued grant
Questions, answered
The things teams ask before they switch.
What can we use today?
Customer Identity is available now. MCP Authorization and Agent Access are available now. Workforce Identity is still a design-partner direction, not a generally available feature.
Is NamoID only for companies in India?
No. Customer Identity uses OAuth, OpenID Connect, PKCE, WebAuthn, JWT, and JWKS. India is where the product has additional depth: DPDP-focused workflows, local operating context, and India deployment requirements. SAML belongs to the Workforce Identity direction, which is not generally available yet.
Does NamoID guarantee DPDP compliance?
No product can make an organization compliant on its own. NamoID provides identity controls and evidence for consent, audit, privacy operations, minimization, and retention. Your organization remains responsible for its notices, purposes, policies, and legal obligations.
Do you have ISO 27001 or SOC 2 certification?
Not yet. We build to both control sets, and our CSA STAR Level 1 assessment is published in the public CSA registry. Control documentation is available on request.
Can we migrate from another identity provider?
Usually, but the work is broader than changing an issuer. Callback and token-validation configuration can often move cleanly through OAuth and OpenID Connect; users, password hashes, linked identities, claims, and existing sessions need an explicit migration plan before production cutover.
Do we have to use Hosted Auth?
Hosted Auth through redirect or popup is the supported Customer Identity path. SDKs handle the OAuth and OpenID Connect mechanics, while NamoID hosts credential collection, passkeys, social sign-in, and MFA. A general native authentication API is not currently offered for production use.
How do MCP Authorization and Agent Access differ?
They point in opposite directions. MCP Authorization protects a server you own when someone else's AI client asks to use it. Agent Access is the other way round: your agent reaching into an account your user owns — their Gmail, their Slack — with a key that expires, instead of their password.
How long does a first Test integration take?
The first milestone is deliberately small: connect one application, register one exact callback, and complete one Hosted Auth flow in Test. The time depends on your framework and existing authentication setup; the setup assistant and direct engineering support are available if you get stuck.
What support do we get?
You can talk directly with the engineers building NamoID. Use the setup assistant for configuration, join the Slack community for implementation questions, or book an engineering call for architecture and migration decisions.
Start in Test
Put your first sign-in in Test. Keep the boundary when AI arrives.
Connect one application, register one exact callback, and complete Hosted Auth. If your product exposes an MCP server, add a separate grant for the resource, actions, audience, consent, and expiry.
No payment card to start Customer Identity · available now MCP Authorization · available now
