Compliance & governance
proConsul is designed to support regulatory and governance requirements for digital identity and trust services, with built-in capabilities for audit trails, evidence management and accountability.
Embedded throughout the platform
GDPR & data protection
Privacy-enhancing technologies are embedded throughout the platform. Data minimisation is achieved through selective-disclosure mechanisms; purpose limitation is enforced through policy controls; storage limitation is handled with automated retention and deletion workflows; and encryption protects personal data at rest and in transit.
Integrated support for data-subject rights requests covers the right of access (efficient retrieval of personal data and processing records), the right to rectification (workflows for updating inaccurate data), the right to erasure (automated deletion with verification), and the right to data portability (export of personal data in structured formats).
Maintain comprehensive records of processing activities as described in GDPR Article 30 — documenting purposes of processing, categories of data subjects and personal data, recipients, international transfers, retention periods and security measures — and generate reports for data-protection authorities.
A framework for conducting and documenting Data Protection Impact Assessments (DPIAs). Template-based assessment workflows guide systematic evaluation of privacy risks, document risk-mitigation measures and residual risks, and maintain DPIA records for regulatory accountability and internal governance.
Data-protection mechanisms — encryption, access controls, audit logging and privacy-preserving processing — engineered to align with GDPR
eIDAS 2.0 & EUDI Wallet
Orchestrate operations for qualified and non-qualified trust service providers. Manage electronic signatures, seals, timestamps and registered electronic delivery, and coordinate with supervisory bodies and conformity-assessment bodies.
Engineered to align with national EUDI Wallet implementations following the Architecture Reference Framework (ARF). Orchestrate Person Identification Data (PID) issuance, qualified and non-qualified electronic attestations of attributes (QEAA/EAA), and wallet attestation, with support for cross-border recognition.
Coordinate qualified electronic-signature creation and validation, integrate with remote qualified signature-creation devices, and support qualified certificates and advanced electronic signatures — with signature-policy management engineered to align with eIDAS.
Manage trust frameworks defining governance rules, liability regimes and technical requirements. Document trust-scheme operators, trust service providers and relying parties, maintain trust lists, and support mutual-recognition arrangements between member states.
European Union Trusted Lists (EUTL) integration — how proConsul stays synchronised with authoritative trust-service status information
Sectoral regulation
Engineered to align with KYC/AML requirements (4AMLD, 5AMLD, 6AMLD), Strong Customer Authentication (PSD2), MiFID II investor identification and FATF guidance on digital identity — with transaction monitoring and suspicious-activity reporting integration.
Healthcare professional credentialing, patient identity management supporting clinical safety, and medical-device operator authentication — designed to consider healthcare data-protection requirements and professional-secrecy obligations.
SIM registration and subscriber identification (GSMA requirements), network-access authentication, and lawful-intercept and data-retention support across telecommunications regulatory frameworks.
Critical-infrastructure protection and operator credentialing, smart-grid authentication and IoT device management, alignment with NERC CIP and sector-specific cybersecurity frameworks, and supply-chain and vendor identity verification.
Audit trails & reporting
Governance framework
Formal policy development, review, approval and publication workflows. Version control maintains policy history; impact analysis precedes changes; stakeholder review and consultation processes apply; and retirement and archival procedures close the loop.
Segregation of duties enforced through role-based access control. Policy controls prevent conflicts of interest; multi-person approval is required for sensitive operations; maker-checker workflows govern configuration changes; and oversight roles have view-only access for monitoring.
A risk register captures identified risks to digital-identity operations. Risk-assessment workflows use standardised criteria; mitigation planning is tracked; residual-risk acceptance authority is documented; and regular review is reported to governance bodies.
Formal change control for platform configuration and policy modifications. Change requests move through impact analysis, testing and approval gates, with rollback for failed changes, a full change history and audit trail, and emergency-change procedures under enhanced oversight.
Standards & frameworks
proConsul is engineered to align with these standards and regulatory frameworks; naming them indicates design alignment and intended support, not certification or membership of any trust list. Organisations deploying proConsul remain responsible for their own compliance programmes and should conduct appropriate assessments with qualified legal and compliance advisers.
Our compliance and governance specialists can help you understand how proConsul supports your regulatory obligations.