Skip to content

Compliance & security

How HelixIAM helps you meet security and regulatory obligations — and how to operate it securely.

In this section

  • OpenID / FAPI conformance — the OpenID Connect and FAPI profiles Helix implements, and how to run the conformance suite against your install.
  • OpenID Connect conformance-suite run — a self-run of the OpenID Foundation conformance suite against all 13 OpenID Connect OP certification plans: 0 failures in 413 module runs, every warning explained. Not OpenID Certification.
  • Compliance program — where Helix fits in SOC 2, ISO 27001, and NL eID accreditation, including the internal penetration test of 2026-10-15 (no exploitable finding; an independent third-party penetration test is in preparation).
  • Security hardening — the checklist for a production-grade, locked-down deployment.
  • GDPR & privacy — data-subject rights (export, erasure, consent) built into the platform.
  • Accessibility (WCAG 2.1 AA) — the self-assessed conformance status of the sign-in pages and account console, how it is tested, and the known gaps.
  • BSN handling — how the Dutch citizen service number is stored encrypted per realm, masked in the console and released only to applications a realm-admin opts in.
  • Data retention — the scheduled cleanup of expired rows, and the audit-log retention policy.
  • Events & audit — the tamper-evident audit log and SIEM forwarding that underpin every compliance claim.

See also