Assurance at Essence: built to be checked, not just trusted
Essence is designed so that its most important promises can be checked: no key to vault content, a separate deployment for each country, and a record of every action. Here is what your assessors can examine.
Most platforms ask buyers to take the vendor's word. Essence is designed so that its most important promises can be checked: it holds no key to the content of a vault, each country's data sits in its own deployment, and every action leaves a record that cannot be quietly rewritten. This page sets out what is built, what we have mapped, and what your assessors can examine.
Promises the architecture keeps
The strongest assurance is a promise the system cannot break. Five of ours are built into how Essence works:
- No key to vault content. Content is encrypted on the person's own device before it leaves. Essence holds no key that can open it, in escrow or anywhere else, so someone who broke into our servers would find ciphertext.
- A separate deployment for each country. Each country's instance has its own databases, its own keys and its own certificate chain. Personal data moves between two countries only when a person starts a cross-border action, under their consent. Where your data lives sets out what stays in the country and what may cross a border.
- A record that only grows. An append-only record of who did what covers the people who run the platform as well as the people who use it. People can see their own access history, and each share keeps a history of its own.
- Erasure by destroying keys. When data has to go, the keys that read it are destroyed, so copies left in backups cannot be read. The encryption that protected the data becomes the means of removing it.
- Cryptography that can move on. Every encrypted record names the algorithm that protected it, so the cryptography can be upgraded without starting again. A new algorithm is designed to arrive in an ordinary release: new data adopts it, and existing data stays readable.
Security at Essence describes each of these protections in detail.
Mapped to the frameworks your assessors use
An assessor starting from a blank page has a long road. We have done the groundwork, mapping our controls against the frameworks public bodies and regulated organisations already use:
- Data protection: our controls are mapped against UK GDPR, EU GDPR and the UAE's personal data protection law, which gives your data protection team a starting point for its own assessment.
- Information security management: ISO/IEC 27001:2022 is mapped across all 93 Annex A controls, with a Statement of Applicability structure in place.
- Cloud security: the NCSC Cloud Security Principles are mapped, with each principle answered and referenced.
These mappings are a head start, not a verdict. They show your assessors where each control sits in the platform and where to look for the evidence, so their own assessment begins with the map already drawn. Between them, the three cover the questions a public body tends to ask first: how personal data is handled and on what basis, how information security is managed, and how a cloud service is protected and operated.
Our independent assurance programme
Architecture and mappings are what we can show today. Independent assurance is the next layer, and our programme includes:
- ISO/IEC 27001 certification: we are preparing for the external audit cycle, with our controls mapped and our evidence collection built.
- Cyber Essentials Plus: our pathway for UK public-sector work is scoped.
- SOC 2 Type II: our programme includes a SOC 2 Type II report, and our system description is prepared.
- The UK trust framework: for the Essence Wallet in the UK, our programme includes preparing for certification under the UK digital verification services trust framework (previously the UK digital identity and attributes trust framework).
Each step builds on the one before it. The architecture gives the controls something real to describe, the mappings show where each control lives, and the evidence collection turns that map into the records an external auditor will sample. It is one body of work, not four separate projects.
What your team can examine
A buyer's security and information governance teams need more than a web page. We share the following with organisations assessing Essence, under a non-disclosure agreement:
- Our security pack. It covers the architecture, key management, data residency, incident response, resilience, and a shared responsibility model that sets out what Essence looks after and what stays with you.
- Answers to standard security questionnaires. Send us yours, and we will complete it, so your team can compare Essence with other suppliers on your own terms.
- The picture a DPIA needs. The data flows and residency detail behind a data protection impact assessment, so your data protection officer can see what is collected, where it is held and on what basis it moves, building on Where your data lives and Consent and the lawful basis.
- Inspection and audit rights over a sovereign instance. For a national authority considering its own instance, we offer inspection and audit rights over that instance.
Talk to our team
If your assessors would like to start with the security pack, a questionnaire or a walk through the architecture, we would be glad to hear from them.
Last reviewed 10 October 2026