Identity as a Service:Compliance standards

Personal Information Protection Law (PIPL)

IDaaS CIAM provides the following features to help enterprises comply with PIPL.

User privacy protection

• Data encryption: Sensitive fields — including passwords and email addresses — are encrypted using AES-256. Password fields use SHA256+salt to prevent brute-force attacks.

• Consent terms management: Supports unified management of consent terms across multiple applications. Legal teams can centrally edit and publish terms content. The system records each user's consent for auditing and compliance purposes.

Cross-border data transfer

For enterprises that transfer data outside China, IDaaS CIAM supports data export security assessments to help meet the requirements of the national cyberspace administration.

Level 3 Classified Protection (CPCS 2.0)

IDaaS CIAM holds the Level 3 certification under the Classified Protection of Cybersecurity (CPCS) 2.0 framework, issued by the Ministry of Public Security. This certification confirms that the service meets national standards for architecture security, data security, and infrastructure security.

The following measures underpin this certification:

• Microservices multi-zone deployment: Each microservice is deployed on ECS instances across different zones, with high availability load balancing provided by SLB.

• Independent VPC isolation: IDaaS CIAM runs in a dedicated Virtual Private Cloud (VPC) using tunnel technology to achieve data-link layer isolation, providing a secure and isolated network environment.

General Data Protection Regulation (GDPR)

IDaaS CIAM provides features to help multinational enterprises meet GDPR requirements.

• Self-service data management: Users can view their data, review authorized terms, and revoke authorizations through a self-service portal.

• Data minimization: The system collects only the minimum data required for business objectives and enforces strict access controls to restrict unauthorized data access.

Health Insurance Portability and Accountability Act (HIPAA)

IDaaS CIAM provides the following features to help healthcare enterprises meet HIPAA requirements.

• Data encryption: All sensitive health data is encrypted and stored using AES-256.

• Access control: Strict permission management policies limit access to sensitive data to prevent data breaches.

ISO 27001 and ISO 27018

IDaaS CIAM has obtained ISO 27001 and ISO 27018 certifications. These certifications confirm that the system has comprehensive information security management processes and the capabilities to protect personally identifiable information (PII).

Payment Card Industry Data Security Standard (PCI DSS)

IDaaS CIAM holds PCI DSS certification, ensuring the security of payment-related data.

• Data encryption: All payment data is encrypted for both storage and transmission.

• Log audit: All payment operations are logged to maintain a transparent and traceable payment process.

SOC 2

IDaaS CIAM has passed the SOC 2 audit, meeting international standards for security, availability, and confidentiality. The system supports generating compliance reports covering user behavior, data access, and permission changes to satisfy regulatory and audit requirements.