Understanding compliance posture
The Verification page, under Settings, then Verification, has a Posture tab. It gives you three views of your identity-verification configuration: a Levels matrix, a Your setup summary written in plain sentences, and a Standards mapping you can expand to see how each setting lines up with the standard it relates to. Every row is computed live from your current settings.
This page explains what each status means and how each row earns it.
Levels
Section titled “Levels”The Levels section of the Posture tab shows, for identified and high-assurance, which methods reach the level and on which of your channels. National eID is named by each scheme that runs, such as MitID, and MitID Erhverv on a MitID connection that accepts it, at the level the National eID tab’s A verification counts as sets. Below it, Tools on this workspace at high-assurance and Tools on this workspace at identified count the tools that ask for each level. A tool declared A customer’s company counts under high-assurance whatever level it is set to, since only National eID at high-assurance opens it. A tool declared A customer counts at the level it is set to. A tool without a scope declaration under Settings → Customer records is refused on every call and counts at neither level. Each count links to the MCP hub. See Assurance levels for how levels, risk and scope fit together.
The three statuses
Section titled “The three statuses”| Status | Meaning |
|---|---|
| Follows | Your configuration matches the standard’s default expectation. The row shows green. |
| Aligned with | Your configuration differs from the default and still respects the standard’s principles. An auditor sees a deliberate deviation with the reasoning shown, and the row stays neutral. |
| Reduced | Your configuration sits below what the standard expects. The row is highlighted so the choice stays visible and deliberate. |
How a row earns its status
Section titled “How a row earns its status”Each row is recomputed from your settings the moment you change them. The rows you can see:
- NIST SP 800-63B §5.1.3 (OOB principles): appears when the email verification link is turned on, and is always “Aligned with”. The signed email link is modelled on out-of-band principles as a possession factor. NIST reserves §5.1.3 conformance for device-bound authenticators, so the status here is aligned-with and the row stays capped there whatever else you configure.
- NIST SP 800-63B §7.2 (session management): “Follows” when high-assurance is re-asked after at most 30 minutes of inactivity and at most 12 hours, the defaults. “Aligned with” when either window is longer. A verification stays scoped to the conversation it happened in. Each channel applies the rule that fits it: a phone call is one continuous session, while an email or chat reasks after a gap.
- NIST SP 800-63B-4 §3.1.3.2 (limits on push requests): appears when a National eID connection is switched on with its credentials and National eID is switched on for the workspace, and is “Aligned with”. Each customer gets at most three eID app approvals, three eID verification links in live chat and three by email within the lockout duration, counted since the customer’s last successful eID verification.
- GDPR Art. 5(1)(e) storage limitation: “Follows” when identity events are retained for 12 months or more, “Aligned with” below 12 months. A scheduled retention sweep runs daily and deletes identity events past each workspace’s configured period, so the storage-limitation claim is enforced in practice.
- NIST SP 800-63B §4 (authenticator assurance): appears as “Reduced” when a channel’s Caller ID or Email sender address is set to Identifies the customer. A calling number can be faked and a sender address forged, so accepting either alone sits below the authentication baseline. The row names the channels where it applies.
- NIST SP 800-63B §5.1.3 (out-of-band authenticators): appears as “Reduced” when an email channel is allowed to deliver the possession link in-band, on the same channel the conversation is already on. The link is still addressed to the address on the customer’s record, so opening it proves control of that mailbox. The row names the email channels where it applies.
Once a National eID connection runs, the Your setup summary names where, per country and scheme: the app approval on phone calls and the verification link by email and in live chat, for example “Denmark (MitID): the app approval on phone calls and the verification link on email and chat.” A completed approval reaches high assurance on its own at the default level (A verification counts as on the National eID tab), and the session rules above apply to it as to every method: a verification stays scoped to the conversation it happened in, and high-assurance is re-asked after the configured inactivity and absolute windows. A MitID verification is valid for at most 5 hours, also where a configured window is longer, and the Validity row of the Your setup summary says so while a MitID connection is switched on with its credentials.
While National eID is switched off for the workspace, on the National eID tab, the National eID row of Your setup reads “National eID is switched off on the National eID tab.”, and the MitID sentence of the Validity row and the limits on push requests row return when it is switched on again.
When you change a setting, the matching row updates immediately. The posture view has no separate save step.
What auditors see
Section titled “What auditors see”The Posture tab is operator-facing: it is your own view of your configuration. oHallo’s own compliance posture, meaning the DPA addendum, the sub-processor list and security-questionnaire answers, comes from your account contact and stands independent of these per-workspace settings.
The identity events log is the evidentiary record auditors usually request. Open it from the View identity events for this workspace link on the Posture tab. Every verification attempt, every lockout and every successful identification is recorded there with a timestamp.