{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "entrust-identity-verification", "name": "Entrust Identity Verification (formerly Onfido)", "vendor": "Onfido Ltd (Entrust)", "vendorUrl": "https://www.entrust.com/products/identity-verification", "kind": "http-api", "category": "identity-verification", "summary": "Entrust Identity Verification, formerly Onfido, checks identity documents, selfies and liveness, runs watchlist and database checks and orchestrates them in Workflow Studio. Agents use the Onfido Public API v3.6 in EU, US and CA regions.", "url": "https://www.anchorterminal.com/tools/entrust-identity-verification", "markdownUrl": "https://www.anchorterminal.com/tools/entrust-identity-verification.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/entrust-identity-verification.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/entrust-identity-verification.json", "repo": "https://github.com/onfido/onfido-openapi-spec", "license": "Proprietary service under Entrust's terms. The OpenAPI spec and the server libraries (onfido-java, onfido-node, onfido-php, onfido-python, onfido-ruby) are MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@onfido/api" }, { "registry": "pypi", "name": "onfido-python" } ], "auth": "mixed", "authNotes": "API tokens per region and environment (`api_live.`, `api_sandbox.`, with `_us` and `_ca` variants) sent as `Authorization: Token token=\u003ctoken\u003e`, generated in the Dashboard under Developers, API authentication. From v3.6, OAuth client credentials issue 60-minute access tokens, with scopes and a per-application IP allowlist set in the Dashboard. Tokens remain valid until revoked. SDK tokens are separate and scoped to one workflow run. Live checks need billing details on the account (checked 2026-10-14).", "pricing": "paid", "pricingNotes": "No price list was readable. Entrust's pricing page answered 403. The UK G-Cloud 14 listing by Onfido Ltd gives £0.43 to £2.12 a transaction and says a free trial with sandbox access is available. Sandbox requests aren't charged (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index, the API v3.6 reference or the OpenAPI spec (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 59334, "pypiWeekly": 26714, "asOf": "2026-10-14" }, "docsUrl": "https://documentation.identity.entrust.com/", "llmsTxt": "https://documentation.identity.entrust.com/llms.txt", "openapi": "https://github.com/onfido/onfido-openapi-spec/blob/master/openapi.yaml", "capabilities": [ "kyc.identity", "kyc.documents", "kyc.screening" ], "tags": [ "hosted", "api-key", "oauth", "openapi", "llms-txt", "webhooks", "sandbox", "status-page", "python", "typescript", "java", "ruby", "php", "soc2", "iso27001" ], "lastRelease": "2026-08-31", "graded": true, "anchor": { "graded": true, "score": 62.1, "grade": "B", "agentReady": false, "rank": 472, "ranked": true, "rankOf": 1076, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 58, "payments": 20, "reliability": 70, "schema": 84, "security": 58, "transparency": 70 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Read with the hosted lines and scored on the Public API v3.6. status.onfido.com is a Statuspage with API, Dashboard, Document Verification, Facial Similarity, Watchlist, Webhooks and other components for the EU, US and CA regions (20). Eight incidents between 24 July and 30 September 2026. Two are labelled major and both were short, a Web SDK outage in all regions from 13:21 to 13:45 UTC on 1 September with a postmortem, and the UK eVisa government service down for 26 minutes on 22 September. A faulty deployment rejected valid tokens on the CA Public API from 14:30 to 15:30 UTC on 7 September, labelled minor, and US report processing was delayed for about an hour on 27 July. We scored 15 rather than 20 because a core API was unavailable in one region for an hour (15). Limits have numbers, 400 requests a minute in live (7 a second, burst 14) and 120 in sandbox (15). A 429 returns `rate_limit` with advice to try later. No Retry-After header and no idempotency key on POST were found (5). The UK G-Cloud 14 listing by Onfido Ltd states 99.5 per cent monthly uptime. It is a government framework listing, not a contract term on Entrust's own site, which we couldn't read (5). v3.6 has been generally available since 24 January 2023 (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 84, "points": 13.65, "reason": "Public OpenAPI 3.0 file for v3.6 in github.com/onfido/onfido-openapi-spec, MIT, with 64 paths and 85 operations (25). llms.txt and a Markdown copy of each docs page (10). Operation descriptions have a median of 60 characters and 20 of 85 are under 40, though the guides explain workflow runs, checks and reports at length (13 of 20). The spec carries 44 enums and typed schemas, with webhook payloads and report breakdowns typed (12 of 15). The API reference documents an error object with `type`, `message` and `fields` and a table of codes per status. The spec itself holds few examples (12 of 15). A versioned path, a written versioning policy and tagged spec releases. The API release notes page has no entry after 27 February 2023 (12 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "No field selection. Applicant lists take `per_page` up to 500, while workflow run lists have a fixed page size of 20 (12 of 25). `page` and `per_page`, Link headers and `X-Total-Count`, and workflow run filters by status, tags, dates and applicant (16 of 20). Errors carry a type such as `validation_error`, `expired_token` or `geoblocked_request` with a message and field list (18 of 20). No idempotency key on POST. Webhooks are delivered at least once and the docs ask handlers to treat events as idempotent (6 of 20). Official server libraries in Java, Node.js, PHP, Python and Ruby, generated from the spec, with webhook verification built in. A verification still needs an applicant, a capture step by the end user and a check or workflow run (13 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 58, "points": 10.15, "reason": "Two credential types. Region-specific API tokens (`api_live.`, `api_sandbox.`) sent as `Authorization: Token token=`, and from v3.6 OAuth client credentials with 60-minute access tokens, scopes and a per-application IP allowlist set in the Dashboard. Tokens stay valid until revoked and the docs advise rotation when staff leave (25 of 30). OAuth scopes allow a narrower credential, sandbox tokens can't manage live webhooks, and applicant deletion is queued with a configurable delay during which the applicant can be restored. No confirmation step for deletes (12 of 20). Responses carry text extracted from identity documents and watchlist hits, with no injection guidance found (3 of 15). Dashboard audit logs exist, must be enabled on the account, and can be pushed with an `audit_log.created` webhook (10 of 15). The G-Cloud listing names ISO/IEC 27001 (accredited 12 September 2023) and SOC 2 Type II. entrust.com/.well-known/security.txt and Entrust's security pages answered 403, and no bug bounty was found (8 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). Entrust's pricing page answered 403. The G-Cloud 14 listing by Onfido Ltd gives £0.43 to £2.12 a transaction, a public range rather than a price list (10 of 20). The G-Cloud listing says a free trial with sandbox access exists, and the docs say sandbox requests aren't charged. We couldn't confirm whether a trial needs a card or a sales contact (10 of 20). Tokens are generated in the Dashboard by a person, and live checks need billing details first (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 58, "points": 5.08, "reason": "The spec repository was refreshed on 31 August 2026 and tagged v6.2.0. The npm `@onfido/api` 6.2.0 and PyPI `onfido-python` 6.2.0 date from 21 and 22 May 2026 (20). Spec refreshes on 27 and 31 August, but fewer than three dated releases of the API or server libraries in the last 90 days were found (10 of 20). A closed service with a support address and public GitHub repositories. Issue response times weren't sampled (8 of 15). Current official libraries in five languages, regenerated from the spec (15). Libraries are MIT and generated with OpenAPI Generator. CI wasn't checked (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "note": "editorial 52, provenance 87", "reason": "The OpenAPI spec and the server libraries are MIT. The service terms and the product privacy notice redirect to entrust.com, which answered 403 to every request, so they weren't read (12 of 30 on what we could read). The API reference says EU data is stored in Ireland with backup in Germany, sandbox data isn't processed by third parties, and deleted applicants are queued for deletion after a delay of at least 30 days by recommendation, set through client support (12 of 30). The versioning policy promises at least 18 months' notice before a version is deprecated, sent by email every 30 days and by response headers (18 of 20). Three regional hosts with stated storage locations. No sub-processor list was read (10 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "No field selection. Applicant lists take `per_page` up to 500, while workflow run lists have a fixed page size of 20 (12 of 25). `page` and `per_page`, Link headers and `X-Total-Count`, and workflow run filters by status, tags, dates and applicant (16 of 20). Errors carry a type such as `validation_error`, `expired_token` or `geoblocked_request` with a message and field list (18 of 20). No idempotency key on POST. Webhooks are delivered at least once and the docs ask handlers to treat events as idempotent (6 of 20). Official server libraries in Java, Node.js, PHP, Python and Ruby, generated from the spec, with webhook verification built in. A verification still needs an applicant, a capture step by the end user and a check or workflow run (13 of 15).", "maintenance": "The spec repository was refreshed on 31 August 2026 and tagged v6.2.0. The npm `@onfido/api` 6.2.0 and PyPI `onfido-python` 6.2.0 date from 21 and 22 May 2026 (20). Spec refreshes on 27 and 31 August, but fewer than three dated releases of the API or server libraries in the last 90 days were found (10 of 20). A closed service with a support address and public GitHub repositories. Issue response times weren't sampled (8 of 15). Current official libraries in five languages, regenerated from the spec (15). Libraries are MIT and generated with OpenAPI Generator. CI wasn't checked (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). Entrust's pricing page answered 403. The G-Cloud 14 listing by Onfido Ltd gives £0.43 to £2.12 a transaction, a public range rather than a price list (10 of 20). The G-Cloud listing says a free trial with sandbox access exists, and the docs say sandbox requests aren't charged. We couldn't confirm whether a trial needs a card or a sales contact (10 of 20). Tokens are generated in the Dashboard by a person, and live checks need billing details first (0).", "reliability": "Read with the hosted lines and scored on the Public API v3.6. status.onfido.com is a Statuspage with API, Dashboard, Document Verification, Facial Similarity, Watchlist, Webhooks and other components for the EU, US and CA regions (20). Eight incidents between 24 July and 30 September 2026. Two are labelled major and both were short, a Web SDK outage in all regions from 13:21 to 13:45 UTC on 1 September with a postmortem, and the UK eVisa government service down for 26 minutes on 22 September. A faulty deployment rejected valid tokens on the CA Public API from 14:30 to 15:30 UTC on 7 September, labelled minor, and US report processing was delayed for about an hour on 27 July. We scored 15 rather than 20 because a core API was unavailable in one region for an hour (15). Limits have numbers, 400 requests a minute in live (7 a second, burst 14) and 120 in sandbox (15). A 429 returns `rate_limit` with advice to try later. No Retry-After header and no idempotency key on POST were found (5). The UK G-Cloud 14 listing by Onfido Ltd states 99.5 per cent monthly uptime. It is a government framework listing, not a contract term on Entrust's own site, which we couldn't read (5). v3.6 has been generally available since 24 January 2023 (10).", "schema": "Public OpenAPI 3.0 file for v3.6 in github.com/onfido/onfido-openapi-spec, MIT, with 64 paths and 85 operations (25). llms.txt and a Markdown copy of each docs page (10). Operation descriptions have a median of 60 characters and 20 of 85 are under 40, though the guides explain workflow runs, checks and reports at length (13 of 20). The spec carries 44 enums and typed schemas, with webhook payloads and report breakdowns typed (12 of 15). The API reference documents an error object with `type`, `message` and `fields` and a table of codes per status. The spec itself holds few examples (12 of 15). A versioned path, a written versioning policy and tagged spec releases. The API release notes page has no entry after 27 February 2023 (12 of 15).", "security": "Two credential types. Region-specific API tokens (`api_live.`, `api_sandbox.`) sent as `Authorization: Token token=`, and from v3.6 OAuth client credentials with 60-minute access tokens, scopes and a per-application IP allowlist set in the Dashboard. Tokens stay valid until revoked and the docs advise rotation when staff leave (25 of 30). OAuth scopes allow a narrower credential, sandbox tokens can't manage live webhooks, and applicant deletion is queued with a configurable delay during which the applicant can be restored. No confirmation step for deletes (12 of 20). Responses carry text extracted from identity documents and watchlist hits, with no injection guidance found (3 of 15). Dashboard audit logs exist, must be enabled on the account, and can be pushed with an `audit_log.created` webhook (10 of 15). The G-Cloud listing names ISO/IEC 27001 (accredited 12 September 2023) and SOC 2 Type II. entrust.com/.well-known/security.txt and Entrust's security pages answered 403, and no bug bounty was found (8 of 20).", "transparency": "The OpenAPI spec and the server libraries are MIT. The service terms and the product privacy notice redirect to entrust.com, which answered 403 to every request, so they weren't read (12 of 30 on what we could read). The API reference says EU data is stored in Ireland with backup in Germany, sandbox data isn't processed by third parties, and deleted applicants are queued for deletion after a delay of at least 30 days by recommendation, set through client support (12 of 30). The versioning policy promises at least 18 months' notice before a version is deprecated, sent by email every 30 days and by response headers (18 of 20). Three regional hosts with stated storage locations. No sub-processor list was read (10 of 20)." }, "sources": [ { "what": "docs landing page", "url": "https://documentation.identity.entrust.com/", "seen": "2026-10-14" }, { "what": "docs index for agents", "url": "https://documentation.identity.entrust.com/llms.txt", "seen": "2026-10-14" }, { "what": "API v3.6 reference (Markdown)", "url": "https://documentation.identity.entrust.com/api/latest.md", "seen": "2026-10-14" }, { "what": "API versioning policy", "url": "https://documentation.identity.entrust.com/api/api-versioning-policy.md", "seen": "2026-10-14" }, { "what": "API release notes", "url": "https://documentation.identity.entrust.com/api/release-notes.md", "seen": "2026-10-14" }, { "what": "quick start guide, tokens and billing", "url": "https://documentation.identity.entrust.com/getting-started/quick-start-guide.md", "seen": "2026-10-14" }, { "what": "OpenAPI spec repository", "url": "https://github.com/onfido/onfido-openapi-spec", "seen": "2026-10-14" }, { "what": "status incidents (JSON)", "url": "https://onfido.statuspage.io/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "status components (JSON)", "url": "https://onfido.statuspage.io/api/v2/components.json", "seen": "2026-10-14" }, { "what": "G-Cloud 14 service listing by Onfido Ltd", "url": "https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/services/168785180660845", "seen": "2026-10-14" }, { "what": "npm @onfido/api", "url": "https://registry.npmjs.org/@onfido/api", "seen": "2026-10-14" }, { "what": "PyPI onfido-python", "url": "https://pypi.org/pypi/onfido-python/json", "seen": "2026-10-14" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=onfido", "seen": "2026-10-14" }, { "what": "domain registration", "url": "https://rdap.verisign.com/com/v1/domain/onfido.com", "seen": "2026-10-14" }, { "what": "security.txt (403)", "url": "https://www.entrust.com/.well-known/security.txt", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: www.entrust.com answered 403 to curl and to our reader on every page tried (product page, pricing, terms, the product privacy notice PDF, security.txt). The terms, privacy notice, pricing, sub-processors and security programme are unread. This may mean the listing should be held", "unchecked: documentation.identity.entrust.com/robots.txt answered 403, so its rules couldn't be read. The docs pages themselves answered normally", "Whether a new customer can sign up self-serve. dashboard.onfido.com/signup returns a JavaScript app with no readable content", "The G-Cloud 14 listing dates from 2024, so the price range and uptime figure may be out of date", "The spec repository tag v6.2.0 is dated 31 August 2026 while the npm and PyPI 6.2.0 releases date from May 2026", "No official MCP server. Two third-party Onfido servers are in the official MCP registry (io.github.codespar/mcp-onfido, io.usefulapi/onfido) and weren't graded" ] }, "negative": 0, "verdict": "The v3.6 API has a public MIT OpenAPI file, server libraries in five languages, OAuth client credentials with scopes and an 18-month deprecation notice. Entrust's own site answered 403, so terms, privacy notice, pricing and security.txt weren't read. There is no idempotency key, and live tokens need a Dashboard account with billing details.", "bestFor": "A company already contracted with Entrust that wants an agent to create applicants, start workflow runs and read reports through typed libraries and a public spec.", "strengths": [ "Public OpenAPI 3.0 file for v3.6 (85 operations, MIT) with official libraries in Java, Node.js, PHP, Python and Ruby", "OAuth client credentials with scopes and a per-application IP allowlist, alongside region-specific API tokens", "Rate limits stated, 400 requests a minute live and 120 in sandbox, with a free sandbox that returns predetermined results", "Written versioning policy with at least 18 months' notice before a version is deprecated", "Webhooks signed with HMAC-SHA256, retried five times over 10 hours and resendable for 30 days" ], "weaknesses": [ "entrust.com answered 403 to every request, so the terms, privacy notice, pricing page and security.txt weren't read", "No idempotency key on POST and no Retry-After header on 429", "The API release notes page has no entry after 27 February 2023", "A faulty deployment rejected valid tokens on the CA Public API for an hour on 7 September 2026", "Pricing is known only as a range of £0.43 to £2.12 a transaction from a 2024 UK G-Cloud listing" ], "agentNotes": [ "Use the regional host for the account (api.eu, api.us or api.ca.onfido.com/v3.6). v3.6 has no default region", "Prefer an OAuth client with only the scopes the task needs over a live API token, and refresh the 60-minute access token", "Stay under 400 requests a minute live and 120 in sandbox, and back off on a 429 `rate_limit` error", "Check before retrying a POST. There is no idempotency key, so a retry can create a second applicant or check", "Treat webhook events as duplicates or out of order, and verify `X-SHA2-Signature` over the raw body" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.1 } ], "editorialScores": { "ergonomics": 65, "maintenance": 58, "payments": 20, "reliability": 70, "schema": 84, "security": 58, "transparency": 52 }, "provenanceScore": 87 }, "connect": { "install": "pip install onfido-python" }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/entrust-identity-verification" }, "notable": [ "Onfido's developer docs moved to documentation.identity.entrust.com after the acquisition. API hosts remain api.eu.onfido.com, api.us.onfido.com and api.ca.onfido.com (https://documentation.identity.entrust.com/api/latest.md)", "Rate limits are 400 requests a minute in live (7 a second, burst 14) and 120 in sandbox (2 a second, burst 4) (https://documentation.identity.entrust.com/api/latest.md)", "The versioning policy promises at least 18 months' notice before an API version is deprecated (https://documentation.identity.entrust.com/api/api-versioning-policy.md)", "The OpenAPI 3.0 file for v3.6 has 64 paths and 85 operations, MIT, last refreshed on 31 August 2026 (https://github.com/onfido/onfido-openapi-spec)", "status.onfido.com lists eight incidents between 24 July and 30 September 2026, including an hour of rejected tokens on the CA Public API on 7 September (https://onfido.statuspage.io/api/v2/incidents.json)", "www.entrust.com answered 403 to every request, including the terms, privacy notice, pricing page and security.txt (https://www.entrust.com/pricing)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "Onfido Public API v3.6 (REST over HTTPS) and its OpenAPI file. No official MCP server found" }, { "label": "Regions", "value": "https://api.eu.onfido.com, https://api.us.onfido.com, https://api.ca.onfido.com, no default region in v3.6. EU data stored in Ireland with backup in Germany" }, { "label": "Resources", "value": "Applicants, documents, live photos and videos, motion captures, checks, reports, workflow runs and tasks, watchlist monitors, webhooks, SDK tokens, biometric tokens, passkeys, electronic signatures, results feedback" }, { "label": "Credentials", "value": "API tokens per region and environment, or OAuth client credentials with scopes and IP allowlist (v3.6). SDK tokens scoped to one workflow run" }, { "label": "Rate limits", "value": "Live 400 requests a minute (7 a second, burst 14), sandbox 120 a minute (2 a second, burst 4), token bucket. 429 `rate_limit`" }, { "label": "Pagination", "value": "`page` and `per_page` (applicants up to 500, default 20), workflow runs fixed at 20 with status, tag, date and applicant filters, Link and X-Total-Count headers" }, { "label": "Errors", "value": "`error` object with `type`, `message` and `fields`, codes such as validation_error, expired_token, trial_limits_reached, geoblocked_request, rate_limit" }, { "label": "Webhooks", "value": "HMAC-SHA256 in `X-SHA2-Signature`, 20x expected within 10 seconds, five retries over 10 hours, resend for 30 days, at-least-once and unordered" }, { "label": "Sandbox", "value": "Same endpoints as live with predetermined results, not charged, not sent to third parties. Applicant emails are still sent" }, { "label": "Retention", "value": "Deleting an applicant queues it and its data for deletion after a delay set through client support, at least 30 days recommended, restorable until then" }, { "label": "Libraries", "value": "onfido-java, onfido-node (@onfido/api), onfido-php, onfido-python, onfido-ruby, 6.2.0, generated from the spec with webhook verification" }, { "label": "Status", "value": "status.onfido.com on Statuspage, components per region for API, Dashboard, Document Verification, Facial Similarity, Watchlist, Webhooks, Known Faces and others" }, { "label": "Certifications", "value": "ISO/IEC 27001 and SOC 2 Type II per the G-Cloud 14 listing. Entrust's own security pages unread (403)" } ], "provenance": { "legalEntity": "Onfido Ltd", "domain": "onfido.com", "domainRegistered": "2013-02-22", "endpointOnVendorDomain": true, "terms": "https://www.entrust.com/terms-and-conditions", "privacy": "https://www.entrust.com/sites/default/files/documentation/licensingandagreements/product-privacy-notice-identity-verification-services.pdf", "statusPage": "https://status.onfido.com", "changelog": "https://documentation.identity.entrust.com/api/release-notes", "securityTxt": "unknown", "checked": "2026-10-14", "notes": [ "The UK G-Cloud 14 listing names ONFIDO LTD as supplier. The docs say Onfido is now part of Entrust.", "onfido.com/terms-and-conditions and onfido.com/privacy redirect to the entrust.com URLs above, which answered 403, so neither was read.", "onfido.com/.well-known/security.txt redirects to entrust.com, which answered 403.", "The API answers on api.{eu,us,ca}.onfido.com, an onfido.com subdomain. The docs moved to documentation.identity.entrust.com.", "RDAP for onfido.com gives a registration date of 2013-02-22." ], "score": 87, "checks": [ { "check": "Legal entity named", "value": "Onfido Ltd", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "onfido.com, registered 2013-02-22 (13 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "onfido.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.onfido.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.entrust.com/terms-and-conditions", "state": "unreadable", "reason": "the page answered HTTP 403 to our reader", "readAt": "2026-10-14", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://www.entrust.com/sites/default/files/documentation/licensingandagreements/product-privacy-notice-identity-verification-services.pdf", "state": "not-read", "points": 10, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/entrust-identity-verification.json", "live": { "slug": "entrust-identity-verification", "vendorStatus": { "page": "https://status.onfido.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:10.845654397Z" }, "updatedAt": "2026-10-14T09:39:10.845654397Z" } } }