Glossary

The Acceptance Assurance Framework is Trinsic’s approach to evaluating digital IDs by how they are established and accessed, helping businesses choose evidence that fits their risk requirements. Its categories are Trinsic-specific and should not be treated as certifications or automatic equivalents of NIST or eIDAS levels.

An Acceptance Session is one instance of a user verification through Trinsic. It is associated with a Verification Profile and contains the context for the provider interaction and its outcome. Trinsic’s documentation also calls it a session or verification session.

Account takeover is an attacker gaining unauthorised control of an existing account. Stolen passwords, phishing, compromised sessions and abuse of account recovery can all lead to it.

Age assurance is the set of methods used to establish or estimate a person’s age or age range. It includes age estimation and age verification; self-declaration provides much less confidence. The appropriate method depends on the use case and applicable rules.

Age estimation infers a person’s age or age range from signals such as facial characteristics or account information. It is a form of age assurance and differs from checking age against verified evidence. Its suitability depends on accuracy, implementation and the use case.

Age verification is the stricter end of age assurance: proving a specific age or age band from a trustworthy source rather than estimating or asking. Digital IDs and mDLs suit it well because they can attest age as a single verified fact.

Anti-money laundering covers laws, policies and controls intended to prevent and detect the laundering of criminal proceeds. Measures can include customer due diligence, transaction monitoring and suspicious-activity reporting.

The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, sets directly applicable rules for obliged entities, including customer due diligence and beneficial ownership. It generally applies from 10 July 2027, with later application for specified football-sector entities. It builds on existing AML obligations.

Attribute verification checks a fact about a person, such as age or address. It can avoid collecting a full identity profile, while still checking that the evidence belongs to the person using it.

Authentication checks control of an authenticator associated with an account or identity, such as a passkey. A successful login does not automatically establish how thoroughly the person was identity-proofed.

An authentication assurance level describes the strength of an authentication process under NIST’s Digital Identity Guidelines. Requirements address authenticators and their use. AAL is separate from confidence in the identity-proofing process represented by an IAL.

Authorization determines which actions or resources a person or system is allowed to access. Authentication establishes control of an account or authenticator; authorization applies the permissions and policies governing its use.

A bank-based ID lets a person use an identity established through a bank or banking scheme to identify themselves to other services. The information shared and assurance provided depend on the scheme and its enrolment and authentication processes.

A biometric injection attack feeds manipulated biometric media into a verification process, potentially bypassing its capture device. It differs from deceiving a sensor, so presentation-attack detection alone does not cover every injection route.

A biometric registry stores biometric reference data linked to identity records. Verification compares a sample with an enrolled reference; confidence depends on enrolment quality, matching accuracy and protections against impersonation.

Biometric verification compares a person’s biometric sample, such as their face or fingerprint, with a reference associated with a claimed identity. A match supports the identity check; it does not by itself establish genuine presence.

Customer due diligence is the process of identifying and verifying customers and relevant beneficial owners, understanding the purpose of a business relationship, and monitoring it over time. Its depth depends on risk and applicable requirements.

Consent is a person’s agreement to a specified use or sharing of their data. A wallet approval screen can record a sharing decision, but valid data-protection consent has additional requirements. Consent is one possible lawful basis for processing, not the only one.

In identity verification, coverage describes the countries, populations, credentials and verification methods a service supports. A supported country or provider does not mean every person there is eligible or can complete every check.

Credential issuance is the process through which an issuer creates and delivers a credential. It may follow identity proofing or another eligibility check, but issuing the credential and establishing the underlying facts are separate activities.

Credential presentation is the act of sharing a credential or selected information from it with a verifier. Depending on the format and protocol, the presentation can include evidence of holder control and safeguards against reuse of a captured response.

Credential revocation marks an issued credential as no longer valid before its normal expiry. A verifier may need to check the issuer’s status information in addition to the credential’s signature. Revocation is distinct from temporary suspension and natural expiration.

Credential status indicates whether an issued credential has been revoked, suspended or otherwise assigned a status by its issuer. A credential can have a valid signature while no longer being acceptable for use.

Data minimization means collecting and using personal data that is adequate, relevant and limited to what a purpose requires. In identity checks, asking for an over-18 result instead of a full birth date can reduce disclosure when that is sufficient for the task.

A deepfake is AI-generated or AI-manipulated image, video or audio made to appear authentic. In identity fraud, it can be used to impersonate someone or falsify evidence, including through media injected into a verification process.

A derived ID is an identity credential or representation based on another identity credential or a prior verification. In Trinsic’s terminology, a derivative ID can support reuse, but its trustworthiness depends on the underlying evidence and how the new ID is issued and accessed.

A digital credential is an electronic record of claims about a person, organisation or other subject, such as a licence or qualification. Some credentials use cryptographic protections that allow a recipient to check their origin and integrity.

A digital ID is an electronic means of representing and establishing identity or identity attributes. It may be accessed through an account, app, wallet or electronic card. What it establishes depends on how it was issued and how it is used.

A digital identity is the set of attributes and identifiers that represents a person in a digital context. A person can have different digital identities across services; a digital ID is one means of establishing identity or sharing those attributes.

Digital identity verification confirms a person’s identity through an electronic process. Trinsic focuses on verification using an existing digital ID, such as a bank-based ID or wallet credential, so a person can reuse identity evidence instead of repeating document capture.

Software that lets a holder manage and present digital identity information or credentials. The wallet can be supplied by a different organisation from the credential issuer.

The Digital Services Act, Regulation (EU) 2022/2065, sets EU rules for intermediary services. Covered online marketplaces must collect specified trader information and make best efforts to assess its reliability and completeness before allowing traders to offer products or services.

A digital signature is a cryptographic mechanism used to check the integrity of signed data and its connection to a signing key. It is distinct from the broader legal concept of an electronic signature; legal effect depends on the applicable rules and implementation.

Digital verification services help people prove their identity or attributes electronically. In the UK, the DVS trust framework and government register establish requirements for certified, registered services. A service’s suitability for a particular check depends on its scope and the rules for that use.

Direct mode is a Trinsic integration option that gives your product control over the provider journey using API-returned instructions and data. It can use Trinsic-hosted assistance where supported and needed. Direct integration does not remove a provider’s own authentication or consent requirements.

Document verification assesses whether a document is authentic, unaltered and valid. Checks may examine security features, data consistency, issuer records or chip signatures. Establishing that it belongs to the person presenting it is a separate check.

DORA, Regulation (EU) 2022/2554, sets digital operational resilience requirements for financial entities in scope. These include ICT risk management, incident reporting, testing and third-party risk. An identity service used by a financial firm can fall within that firm’s ICT third-party risk arrangements.

An electronic attestation of attributes is electronic evidence that allows attributes to be authenticated. Under eIDAS, it can be qualified or non-qualified.

An eID is an electronic means of identifying or authenticating a person. In national eID schemes, it may take the form of an app, account or electronic card. Recognition and assurance depend on the particular scheme.

An eID card is a physical identity card with electronic capabilities, typically provided by a chip. Depending on the scheme, it can support online authentication, sharing identity data or electronic signatures. Its capabilities differ from simply displaying a photograph of an ID card.

eIDAS is Regulation (EU) No 910/2014, the EU framework for electronic identification and trust services. It was amended in 2024 to introduce the European Digital Identity Framework.

eIDAS 2.0 is the common name for Regulation (EU) 2024/1183, which amends eIDAS to introduce European Digital Identity Wallets and expand the trust-services framework. Wallet provision and acceptance duties have specific scopes and implementation deadlines.

A European Digital Identity Wallet is a wallet provided or recognised by an EU Member State under eIDAS. It lets users manage and present identity data and attestations. Use is voluntary; relying-party acceptance duties depend on Article 5f and its timelines.

The Financial Action Task Force is the global body that sets anti-money-laundering and counter-terrorist-financing standards, which countries then implement. FATF guidance shapes how digital identity is accepted for KYC worldwide.

The General Data Protection Regulation sets rules for processing personal data in its scope. Its principles include purpose limitation, data minimisation, accuracy and security. Selective disclosure can reduce data sharing, but does not by itself establish a lawful basis or satisfy every GDPR obligation.

A government wallet is a digital wallet provided by a public authority to hold or present credentials. The wallet operator and credential issuer may be different organisations; each credential’s assurance depends on its issuance and security requirements.

A holder possesses and can present a credential. The holder is often the person the credential describes, but the holder and subject can be different.

Holder binding connects use of a credential to a particular holder or cryptographic key. It can require proof of control when presenting the credential, so possession of a copied credential alone is insufficient. The guarantees depend on the credential’s design and verification process.

Hosted mode is a Trinsic integration option in which your product selects the ID Provider and Trinsic handles the required journey to that provider. Trinsic’s interface appears when needed; the provider may still handle its own authentication and consent screens.

An ID Provider is a source of identity verification connected to Trinsic’s acceptance network, such as a digital identity wallet, bank ID, government identity system or database verification service. It is broader than the federation-specific role of an identity provider (IdP).

Identity acceptance lets a business verify someone using a digital ID they already hold. It reuses existing identity evidence while still checking that the evidence and its presentation meet the business’s requirements.

An identity acceptance network connects businesses to multiple digital ID providers through one integration. Each provider still has its own availability, data, assurance and access requirements.

An identity assurance level describes confidence in identity proofing under NIST’s Digital Identity Guidelines. Higher levels require stronger evidence and checks. IAL is separate from authentication assurance and eIDAS assurance levels.

Identity attributes are facts or characteristics associated with a person, such as their name, date of birth or nationality. Credentials and identity assertions can carry claims about these attributes; the source and verification process determine how much confidence to place in them.

An identity broker connects relying parties with identity providers, often handling protocol differences and the exchange of identity assertions. Whether it also has a regulated intermediary role depends on the scheme and jurisdiction.

An identity database check compares or retrieves details against government, registry or other records. It can corroborate a name or ID number, but a match alone does not establish that the applicant owns that identity.

Identity federation lets a service rely on an assertion from another identity system to authenticate a user or receive identity information. The relying party checks the assertion instead of directly checking the user’s authenticator; trust and assurance depend on the federation’s arrangements.

Identity fraud is the deceptive use of another person’s identity, or a fabricated identity, to obtain access, services or another benefit. It can involve stolen identity information, impersonation or synthetic identities.

Identity proofing establishes confidence in a claimed identity by collecting evidence, validating it and checking its connection to the applicant. It is distinct from authenticating a previously enrolled user.

In identity federation, an identity provider authenticates a user and sends an assertion that another service can rely on. The term is also used more broadly in the market. Trinsic’s ID Provider is a wider category that includes wallets and other identity verification sources.

An identity scheme is a system of rules, roles and processes for issuing and using electronic identities. It can govern multiple issuers, identity methods and relying parties, rather than referring to a single app or credential.

Identity verification checks whether someone is the person they claim to be. It can use documents, authoritative records, biometrics or existing digital identities, depending on the required confidence and context.

Impersonation is pretending to be another person or entity. In an identity flow, an attacker may use stolen information, compromised accounts or fabricated media to pass as the legitimate user.

The INFORM Consumers Act requires US online marketplaces to collect and verify specified information from covered high-volume third-party sellers. Generally, the threshold is at least 200 transactions and $5,000 in gross revenue from new or unused consumer products during a continuous 12-month period in the previous 24 months.

ISO/IEC 18013-5 specifies the mobile driving licence application, including data and mechanisms for presenting and verifying an mDL. It supports interoperable exchange, but does not itself make every issuer trusted or every presentation accepted.

ISO/IEC 18013-7 extends the mDL standard to online, unattended presentation, so a mobile driver's license can verify identity over the web, not just in person.

An issuer creates a credential containing claims about a subject. Examples include a licensing authority issuing a driving credential or a university issuing a qualification.

Know Your Business is the common term for due diligence on a business customer. Checks can cover the entity’s registration, ownership, control, beneficial owners and authorised representatives. The required checks depend on the relationship, risks and applicable rules.

Know Your Customer is a common term for the processes a business uses to establish who its customers are and assess relevant risks. In regulated settings it overlaps with customer due diligence, including identity verification and ongoing review.

An assurance level expresses confidence under a particular framework. eIDAS electronic identification uses low, substantial and high; NIST separates identity proofing, authentication and federation assurance. Levels should be interpreted within their own framework, not treated as interchangeable.

Liveness detection looks for evidence that a biometric sample comes from a living person present at capture. It is one approach within presentation-attack detection and does not establish identity or stop every injection attack.

An mdoc is a mobile document using the data and security structures specified in ISO/IEC 18013-5. An mDL is one application; other credential types can use the same structures. Presentation protocols determine how it is exchanged.

A mobile driver’s license is a digital driving credential issued by a licensing authority for use on a mobile device. Standards-based mDLs support cryptographic verification and selective sharing of data. Acceptance depends on the issuer, wallet, verifier and applicable rules.

A national ID is the identity credential a country issues to residents, increasingly with a digital form. Coverage and openness vary widely: some national IDs can be queried by businesses, others are restricted to government use.

NFC chip reading uses short-range wireless communication to read data from a compatible document chip. For an ePassport, validating the issuer’s digital signature checks data integrity and origin. Reading alone does not establish that the document belongs to the presenter.

Normalized identity data is provider output mapped into Trinsic’s common attribute model so an integration can handle different sources consistently. The available fields and their meaning still depend on the provider; normalization does not make all providers return identical data or assurance.

OAuth 2.0 is a framework for authorizing an application to access protected resources with limited permissions. It is not, by itself, an identity-proofing or login protocol; OpenID Connect adds an authentication layer.

An OEM (original equipment manufacturer) wallet is a wallet supplied by a device or operating-system vendor, such as Apple, Google or Samsung. It can hold supported identity credentials alongside other items. The vendor providing the wallet is not necessarily the issuer of those credentials.

The UK Online Safety Act sets safety duties for services in scope. Duties include preventing children from encountering pornography through highly effective age assurance, alongside other protections. The applicable obligations depend on the service, content and risk assessment.

OpenID Connect is an identity layer built on OAuth 2.0 that lets an application authenticate a user and obtain identity claims. It is distinct from OpenID4VP and OpenID4VCI, which address credential presentation and issuance.

OpenID for Verifiable Credential Issuance is a protocol for issuing digital credentials from an issuer to a wallet. It defines issuance interactions and can support different credential formats.

OpenID4VP is the open protocol for requesting and presenting verifiable credentials from a wallet to a verifier. It is a core building block of EUDI Wallet acceptance and of interoperable digital identity generally.

Identity orchestration coordinates checks and routes a user through verification methods according to configured rules. It can include fallback paths based on availability, results or risk requirements.

A politically exposed person is someone who holds or has held a prominent public function. AML frameworks set additional measures for PEPs and can extend measures to family members and close associates. Requirements differ by jurisdiction, PEP type and risk.

Person identification data is the data used to establish a person’s identity under the applicable legal framework. In EUDI Wallets, its required and optional attributes are specified by EU rules; a natural person’s administrative identifier is optional.

A presentation attack attempts to interfere with a biometric system by presenting something deceptive at its capture sensor, such as a printed face photo or mask. Injecting media into the processing pipeline is a different attack route.

Presentation attack detection identifies attempts to deceive a biometric system at its capture sensor. Liveness detection is one approach within PAD. Protection against media injected after capture requires additional controls.

Provider health is Trinsic’s operational signal for whether an ID Provider is responding normally. It helps integrations avoid unavailable providers and handle service disruption. An online status describes availability, not whether a particular user’s verification will succeed.

Provider recommendations help select relevant ID Providers for a user verification through Trinsic. The recommendation API can use profile configuration, location signals and provider health. A recommendation is not proof that a user holds an eligible ID or will complete verification.

Provider registration is the onboarding needed to make an ID Provider available to a relying party through Trinsic. Depending on the scheme, it can involve eligibility checks, contracts, requested attributes and branding. Adding a provider to a profile does not necessarily complete these requirements.

PSD2 is the EU’s revised Payment Services Directive. Its strong customer authentication rules generally require at least two independent elements from knowledge, possession and inherence for specified activities, subject to exemptions. A wallet or eID must meet the relevant requirements to support SCA.

Public key infrastructure is the combination of technology, policies and processes used to manage public keys and digital certificates. It helps systems determine which signing keys to trust and how to handle certificate issuance, validation and revocation.

A qualified electronic attestation of attributes is an EAA issued by a qualified trust service provider that also meets eIDAS Annex V requirements.

A qualified electronic signature is an advanced electronic signature based on a qualified certificate and created using a qualified signature-creation device. Under eIDAS it has the same legal effect as a handwritten signature.

A relying party is a service or organisation that relies on identity information or an authentication result to make a decision. It could be a bank opening an account, a public service accepting a login, or a retailer checking an age attribute.

Reusable identity lets a person use previously established identity information across multiple interactions or services. Reuse can reduce repeated proofing, while still requiring appropriate authentication and checks on the information’s validity and suitability.

A right-to-work check establishes whether someone is permitted to do the proposed work. In the UK, the digital identity route covers holders of valid British or Irish passports, including Irish passport cards. Other cases use prescribed routes such as the Home Office online service; employers retain responsibilities.

Sanctions screening compares people, organisations or transactions with relevant sanctions data to identify potential restrictions. Possible matches need assessment, and screening forms part of a wider compliance process shaped by the applicable sanctions regime and risk.

An SD-JWT is a signed JSON Web Token designed to let its holder disclose selected claims while withholding others. It uses salted hashes to protect undisclosed values. SD-JWT VC applies this mechanism to a credential profile.

Selective disclosure lets a holder share chosen claims from a credential while withholding others. For example, an issuer-provided over-18 claim can be shared without a birth date. Selective disclosure alone does not calculate an age threshold from a hidden date of birth.

A synthetic identity is a fabricated identity assembled from a mixture of genuine and invented information, such as a real identification number paired with a false name. It can be used to create accounts or obtain services under that constructed identity.

A trust framework sets common rules for participants in an identity ecosystem, including roles, assurance requirements, responsibilities and oversight. It gives relying parties a basis for deciding which identity services and credentials to accept.

A trust service provider supplies services such as electronic signatures, timestamps or attribute attestations. Under eIDAS, providers can be qualified or non-qualified; qualified status is granted by the supervisory body for the relevant services.

A verifiable credential is a tamper-evident digital credential whose issuer can be authenticated cryptographically. Verification does not establish that every claim is true. Trust, status and holder checks still matter, and some checks can require network access.

A Verification Profile is a reusable configuration for verification through Trinsic. It brings together provider selection, branding and settings such as data retention and security. Each verification session is associated with a profile.

A verifier receives and checks a credential or presentation. It may be the relying party or perform checks on the relying party’s behalf.

The W3C Verifiable Credentials Data Model defines how to express claims, issuers, subjects and related information in verifiable credentials. It is a data model, used alongside securing mechanisms and exchange protocols.

Zero-Access Encryption is Trinsic’s storage approach for protecting verification results so Trinsic cannot decrypt them at rest when the feature is enabled. It does not mean data is never processed. Disabling the feature allows results to be viewed in the dashboard.

A zero-knowledge proof lets a prover demonstrate that a statement is true without revealing the private information used to prove it. For identity use cases, the statement still needs a trustworthy connection to the credential or facts being asserted.