Compliance around the world
Bringing digital trust through audits and accreditations, independently vetted to the highest international standards.
Compliance accreditations
As a leader in encryption and trusted identity, DigiCert maintains a suite of accreditations and independent audits. Protect your systems and users with the highest levels of assurance, including certification as a Qualified Trust Service Provider (TSP) under ETSI standards.
DigiCert global accreditations
SOC type II
- Trust service requirements: Detail operational effectiveness of systems to manage customer data based on five "trust service principles"—security, availability, processing integrity, confidentiality, and privacy.
- Audit description: Annual audits to ensure data is securely managed to protect the interests of organizations and clients.
- Product/platform: DNSTrust
- Supervisory authority: American Institute of Certified Public Accountants (AICPA)
- Accreditation body/auditor: A-Lign (DNSME)
- Geographical applicability: Global
SOC 2 type II / type III
- Trust service requirements: Detail operational effectiveness of systems to manage customer data based on five "trust service principles"—security, availability, processing integrity, confidentiality, and privacy.
- Audit description: Annual audits to ensure data is securely managed to protect the interests of organizations and clients. SOC 2 replaces legacy SAS 70 reporting standard.
- Product/platform: CertCentral, DigiCert ONE, DigiCert PKI Platform 8
- Supervisory authority: American Institute of Certified Public Accountants (AICPA)
- Accreditation body/auditor: BDO (DigiCert)
- Geographical applicability: Global
WebTrust program for certification authorities (CAs)
- Trust service requirements: Adequacy and effectiveness of controls deployed by a Certification Authority (CA).
- Audit description: Annual audit performed on DigiCert's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting DigiCert public and managed PKI CA services.
- Product/platform: CertCentral, DigiCert ONE, DigiCert PKI Platform 8, MPKI 7 (Japan)
- Supervisory authority: Chartered Professional Accountants of Canada (CPA Canada).
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for network security
- Trust service requirements: CA/B Forum "Network and Certificate Systems Security Requirements"
- Audit description: Annual audit performed on DigiCert's Network and Certificate Systems Security compliance against the CA/B Forum Baseline Network Security Requirements.
- Product/platform: CertCentral, DigiCert ONE, DigiCert PKI Platform 8, TrustLink (QuoVadis Legacy) supporting CA infrastructure.
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for baseline requirements
- Trust service requirements: CA/B Forum "Baseline Requirements for the Issuance and Management of Publicly Trusted Certificates."
- Audit description: Annual audit performed on DigiCert's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting DigiCert public and managed PKI CA services.
- Product/platform: CertCentral, DigiCert PKI Platform 8 (for S/MIME in 2025)
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for extended validation
- Trust service requirements: CA/B Forum "Guidelines for the Issuance and Management of EV Certificates."
- Audit description: Annual audit performed on DigiCert's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting DigiCert public and managed PKI CA services.
- Product/platform: CertCentral
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for code signing
- Trust service requirements: Baseline Requirements for the Issuance and Management of Publicly-Trusted CodeSigning Certificates
- Audit description: Annual audit performed on DigiCert's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting DigiCert public and managed PKI CA services.
- Product/platform: DigiCert ONE Software Trust Manager (STM)
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for S/MIME
- Trust service requirements: Baseline Requirements for the Issuance and Management of Publicly-Trusted S/MIME Certificates
- Audit description: Annual audit performed on DigiCert's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting DigiCert public and managed PKI CA services.
- Product/platform: CertCentral (EU), TrustLink (QuoVadis legacy), CertCentral, PKI8
- Supervisory authority: CPA Canada
- Accreditation body/auditor: EY
- Geographical applicability: Global
WebTrust for Mark Certificate
- Trust service requirements: Based on the Minimum Security Requirements for the Issuance of Mark Certificates.
- Audit description: Annual audit performed on DigiCert's issuance of Mark Certificates.
- Product/platform: CertCentral
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for AATL
- Trust service requirements: Adobe Approved Trust List program, which verifies digital signatures in PDF documents that can be traced back to high-assurance, trustworthy certificates trusted by Acrobat and Reader.
- Audit description: Annual audit performed on DigiCert's issuance of Qualified Certificates.
- Product/platform: CertCentral, DigiCert PKI Platform 8
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
WebTrust for matter
- Trust service requirements: Adequacy and effectiveness of controls deployed by a Certification Authority (CA).
- Audit description: Annual audit performed on DigiCert's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting DigiCert private and matter PKI CA services.
- Product/platform: DigiCert ONE IoT Trust Manager (IoT)
- Supervisory authority: Chartered Professional Accountants of Canada (CPA Canada)
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for X9
- Trust service requirements: Adequacy and effectiveness of controls deployed by a Certification Authority (CA).
- Audit description: Annual audit performed on DigiCert's issuance of X9 Certificates
- Product/platform: CertCentral
- Supervisory authority: Accredited Standards Committee X9
- Accreditation body/auditor: BDO
- Geographical applicability: Global
WebTrust for general private
- Trust service requirements: Adequacy and effectiveness of controls deployed by a Certification Authority (CA).
- Audit description: Annual audit performed on key management cycle management authority (CA) business practices, disclosures and CA environmental controls supporting DigiCert Private PKI CA services.
- Product/platform: CertCentral, DigiCert ONE, DigiCert PKI Platform 8
- Supervisory authority: Chartered Professional
- Accountants of Canada (CPA Canada)
- Accreditation body/auditor: BDO
- Geographical applicability: Global
DigiCert U.S. accreditations
Federal PKI policy authority
- Trust service requirements: NIST SP800-53, which specifies security controls for information systems supporting the executive agencies of the U.S. federal government. Adherence to Common Policy.
- Audit description: Annual audit of services, procedures, and practices as part of the identity federation agreement with the U.S. Government to provide services.
- Product/platform: DigiCert Direct
- Supervisory authority: Federal Public Key Infrastructure Policy Authority (FPKIPA)
- Accreditation body/auditor: Federal Public Key Infrastructure Policy Authority (FPKIPA)
- Geographical applicability: United States
DirectTrust™ accreditation program for Certificate authorities (CAs)
- Trust service requirements: Direct Standard™ and requirements of the DirectTrust Security and Trust framework.
- Audit description: Biennial audit of CA services against a series of technical, physical, and operational criteria.
- Product/platform: DigiCert Direct
- Supervisory authority: DirectTrust
- Accreditation body/auditor: DirectTrust
- Geographical applicability: United States
DirectTrust™ accreditation program for registration authorities (RAs)
- Trust service requirements: Direct Standard™ and requirements of the DirectTrust Security and Trust framework.
- Audit description: Biennial audit of RA services against a series of technical, physical, and operational criteria.
- Product/platform: DigiCert Direct
- Supervisory authority: DirectTrust
- Accreditation body/auditor: DirectTrust
- Geographical applicability: United States
WebTrust for certipath
- Trust service requirements: Adequacy and effectiveness of controls deployed by a Certification Authority (CA).
- Audit description: Annual audits performed on Certipath's key management cycle management authority (CA) business practices disclosures and CA environmental controls supporting Certipath public and managed PKI CA services.
- Product/platform: DigiCert PKI Platform 8
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Americas
WebTrust for DirectTrust
- Trust service requirements: Adequacy and effectiveness of physical controls deployed by a Certification Authority (CA).
- Audit description: Annual audit performed on DigiCert's physical management of DirectTrust CA services.
- Product/platform: DigiCert Direct
- Supervisory authority: CPA Canada
- Accreditation body/auditor: BDO
- Geographical applicability: Americas
DigiCert asia pacific accreditations
ISAE 3402
- Trust service requirements: ISAE 3402, an international assurance standard that describes Service Organization Control (SOC) engagements, which provides assurance to an organization's customer that the service organization has adequate internal controls.
- Audit description: Annual audit on internal controls over financial reporting.
- Product/platform: DigiCert ONE Trust Lifecycle Manager (TLM) (Japan), MPKI 7 (Japan)
- Supervisory authority: International Auditing and Assurance Standards Board (IAASB), International Federation of Accountants (IFAC)
- Accreditation body/auditor: BDO Sanyu
- Geographical applicability: Japan
ISO 27001
- Trust service requirements: Compliance with ISO 27001 Information Security Management Systems Requirements Specification (formerly known as BS7799-2)
- Audit description: Annual audit to evaluate how securely an organization manages and stores its information and data in our Japan Data Center.
- Product/platform: DigiCert ONE Trust Lifecycle Manager (TLM) (Japan), MPKI 7 (Japan)
- Supervisory authority: International Organization for Standardization
- Accreditation body/auditor: BDO Sanyu
- Geographical applicability: Japan
Gatekeeper public key infrastructure framework
- Trust service requirements: Digital ID Policy Branch, Gatekeeper PKI Framework v3.1 (research)
- Audit description: Annual audit that cover protective security governance, personnel security, information security and physical security.
- Product/platform: Gatekeeper (product), MPKI 7 system
- Supervisory authority: Australian Government Department of Finance
- Accreditation body/auditor: Sekuro
- Geographical applicability: Australia
DigiCert european accreditations
ZertES qualified certification services provider
- Trust service requirements: Swiss Law and ETSI standards for Qualified Certification Service Providers (CSP) and Time Stamping Authorities.
- Audit description: Annual audit of DigiCert Switzerland AG to ensure conformity with the requirements for Qualified and Regulated Certificates and Qualified Time-Stamps.
- Product/platform: TrustLink (QuoVadis legacy), CertCentral/DigiCert ONE
- Supervisory authority: Swiss Accreditation Service (SAS), Bundesamt für Kommunikation (BAKOM)
- Accreditation body/auditor: KPMG
- Geographical applicability: Switzerland
Netherlands qualified Trust services provider
- Trust service requirements: ETSI EN 319 411-1, ETSI EN 319 411-2, Regulation (EU) nº 910/2014
- Audit description: Annual audit of QuoVadis Trustlink Netherlands BV for accreditation to be a Qualified Trust Services Provider (QTSP), to issue Qualified Certificates for Electronic Signature, Electronic Seal, Website Authentication and Qualified Time-Stamps.
- Product/platform: TrustLink (QuoVadis legacy), CertCentral/DigiCert ONE
- Supervisory authority: RDI
- Accreditation body/auditor: BSI (QuoVadis legacy), TayllorCox (DigiCert Europe)
- Geographical applicability: Netherlands — but applies across the European Union.
Trust service provider (TSP) for PKIoverheid
- Trust service requirements: ETSI EN 319 411-1, ETSI EN 319 411-2, PKIoverheid Program of Requirements standards to issue Qualified Certificates for Electronic Signature, Electronic Seal and Website Authentication under the Staat der Nederlanden Root.
- Audit description: Annual audit to maintain accreditation as a TSP for the Dutch government.
- Product/platform: TrustLink (QuoVadis legacy), CertCentral/DigiCert ONE
- Supervisory authority: Logius Policy Management Authority for PKIoverheid
- Accreditation body/auditor: BSI (QuoVadis legacy), TayllorCox (DigiCert Europe)
- Geographical applicability: Netherlands
Belgium qualified Trust services provider
- Trust service requirements: ETSI EN 319 411-1, ETSI EN 319 411-2, Regulation (EU) nº 910/2014
- Audit description: Annual audit of DigiCert Europe Belgium BV for accreditation to be a Qualified Trust Services Provider (QTSP), to issue Qualified Certificates for Electronic Signature and Electronic Seal.
- Product/platform: TrustLink (QuoVadis legacy), CertCentral/DigiCert ONE
- Supervisory authority: Belgian FPS Economy - Quality and Safety
- Accreditation body/auditor: BSI (QuoVadis legacy), TayllorCox (DigiCert Europe)
- Geographical applicability: Belgium — but applies across the European Union.
