Tiếng Việt
EnglishGovernance & Policy
Policies, accountability, approval and change control.
QTSP-GRADE ASSURANCE
Trust service assurance model
Twenty control layers spanning legal authorization, identity, cryptography, evidence, operations and transparent disclosure.
ASSURANCE ARCHITECTURE
Twenty-layer operating model
Each layer requires an owner, policy, controls, evidence and an assessment cycle.
Legal Authorization
Licence, scope and legal obligations.
Registration Authority
Registration, representative verification and records.
Identity Proofing
Natural-person and legal-entity identity assurance.
Authentication
MFA, cryptographic keys, OAuth 2.1 and mTLS.
Trust Service Core
S-ERDS, R-ERDS and delivery policy.
Evidence Generation
Events, metadata, hashes and evidence formats.
HSM & Key Management
Key generation, protection, rollover and destruction.
Electronic Seal
Service-controlled sealing of evidence.
Timestamping
Trusted time bound to delivery events.
Certificate Validation
Certificate chains, OCSP, CRL and trust anchors.
Secure Delivery
Confidentiality, integrity and channel authentication.
Evidence Preservation
Long-term retention, integrity and retrievability.
Audit & Logging
Tamper-evident logs and audit evidence.
Incident Management
Classification, response, notification and RCA.
Business Continuity
BCP, DR, backup and recovery testing.
Public Register
Publication of documents, versions, hashes and status.
Complaints & Liability
Complaints, liability, limits and insurance.
Service Termination
Termination planning and records preservation.
Independent Assurance
ISO, conformity assessment, penetration testing and audits.
CLAIMS BOUNDARY
Assurance coverage map
Separates directly applicable evidence, supporting assurance and reference standards.
| Evidence / standard | What it establishes | Relationship to Trusted Delivery |
|---|---|---|
| Vietnamese service licence | Legal authorization within the licensed scope | Direct |
| QCVN 139:2025/BKHCN | Applicable technical and operational requirements | Direct |
| ISO/IEC 27001:2022 | Information security management within the certificate scope | Supporting assurance |
| TAYLLORCOX PAD Level 2 | Presentation-attack resistance of a biometric module | Supporting assurance |
| TAYLLORCOX eID HIGH | Assurance level of the assessed identity module | Supporting assurance |
| QSCD EAL4+ | Assessment of the cryptographic appliance/module within scope | Supporting assurance |
| ETSI EN 319 401 / 521 / 522 | Reference framework for policy, security, architecture and evidence | Reference |
LEGAL CLAIM CONTROL
QTSP status boundary
The site describes a QTSP-grade model and eIDAS-aligned architecture; it does not claim qualified status in the EU Trusted List.
EU QTSP status can only be claimed with a competent supervisory decision and the corresponding Trusted List entry.
E-E-A-T
Editorial information
Changes to assurance scope must be recorded in the Legal Claims Register.
AuthorMobile-ID Trust Services Team
Technical reviewTrust Service Architecture
Legal reviewPending production approval
Updated2026-07-29