STAR Registry Listing for
NamoID
NamoID
NamoID is an India-first OAuth 2.1 / OIDC identity provider (SaaS). It lets developers add secure sign-in, social + India-specific login (WhatsApp OTP, DigiLocker, Aadhaar offline KYC), MFA, and multi-tenant user management to their apps.
Security posture - OAuth 2.1 / OIDC with PKCE mandatory on every flow (no implicit or password grant). - RS256-signed tokens via published JWKS; the private signing key never leaves the service. - Refresh-token rotation with replay-chain revocation. - AES-256-GCM encryption at rest (provider tokens, TOTP secrets) under rotatable keys; TLS in transit. - Strict multi-tenant isolation, append-only audit log, Redis-backed rate limiting.
Privacy (India / DPDP Act 2023) - Data residency in AWS Mumbai (ap-south-1). - Aadhaar masked at rest (last-4 + name-hash; full number and XML never persisted). - Data-subject export + deletion; per-connection consent capture.
Security overview, responsible-disclosure policy, and sub-processors: https://namoid.in/security
Listed Since: 06/27/2026
STAR Level 1
CAIQ Self-assessment v4.1.0
Offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services. It provides a set of Yes/No/NA questions and space to justify the response a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM).
Created or renewed 25 days ago, on June 27, 2026.
