Resources Categories

Back

INDUSTRY FACT FILE · DIGITAL IDENTITY, TRUST & ESIGN

Main Products and Services in Digital Identity, Trust and eSign

What India's Aadhaar ecosystem entities, certifying authorities, eSign providers, KYC platforms and DigiLocker partners deliver, the systems behind each, and where those systems create cyber and compliance exposure.

In this document

1. How identity and trust providers create value

2. Products and services by organisation type

3. The identity layer: enrolment, authentication and KYC

4. The trust layer: certificates, eSign and verified documents

5. The systems behind the products and services

6. Trends that change the attack surface

7. Mapping operations to Codec Networks engagements

1. How identity and trust providers create value

Revenue stream	How it works	Security relevance
Authentication and e-KYC services	Fees for authentication and e-KYC transactions run for relying parties and sub-AUAs	Biometric and OTP flows, e-KYC data handling, vault storage
Network connectivity (ASA)	Secure leased connectivity between requesting entities and the CIDR	Availability, encryption, network segmentation
Enrolment and update services	Enrolment and update centres run under registrar contracts	Operator access, kit integrity, document handling
Digital signature certificates and PKI	Certificates, timestamps, document signing and managed PKI	Key protection, RA processes, certificate issuance integrity
eSign transactions	Per-signature fees charged by ESPs to ASPs and enterprises	Consent, document binding, signing HSMs, audit trails
Onboarding and verification SaaS	Video-KYC, face match, document and fraud checks sold per check or per seat	Deepfake resistance, API security, data retention

2. Products and services by organisation type

Organisation type	Main products and services	Key systems
AUAs and KUAs	Account opening, SIM issue, loan onboarding, benefit delivery and pension life certificates	AUA and KUA servers, Aadhaar Data Vault, HSMs, registered devices
Sub-AUAs and agent networks	Assisted onboarding, Aadhaar-enabled payments, field verification	Agent apps, biometric devices, parent AUA integrations
Authentication service agencies	Secure connectivity, monitoring and redundancy for authentication traffic	Leased lines, routers, encryption, network operations centres
Registrars and enrolment agencies	Resident enrolment, biometric and demographic updates	Enrolment kits, operator logins, document scanning, upload clients
Certifying authorities and ESPs	Digital signature certificates, eSign, timestamping, OCSP and CRLs	CA and RA systems, signing HSMs, e-KYC integration, directories
Application service providers	Signed loan agreements, mandates, policies, HR letters and filings	Web and mobile apps, ESP APIs, document storage
Video-KYC and IDV platforms	V-CIP, face match, liveness, document OCR, fraud scoring	Video platforms, AI models, SDKs, cloud storage, agent consoles

3. The identity layer: enrolment, authentication and KYC

Identity services turn a person into a verifiable record and then answer one question millions of times a day: is this the same person? Enrolment agencies capture biometrics and documents through certified kits and trained operators; UIDAI's CIDR holds the result; authentication service agencies carry encrypted requests from AUAs and KUAs; and relying parties receive a yes or no answer or, for KUAs, an e-KYC response with demographic data and a photograph. Fingerprint, iris, face and OTP methods sit side by side, and face authentication has grown fastest, passing 200 crore cumulative transactions in August 2025 according to UIDAI. The new Aadhaar app adds a digitally signed QR code for offline verification, which lets a resident share selected details without the verifier collecting the Aadhaar number.

The security of this layer depends on many organisations that are not UIDAI. Registered devices must encrypt biometrics at the point of capture so they cannot be stored or replayed, an expectation sharpened after UIDAI's 2017 complaint about replayed biometrics. AUAs and KUAs must keep Aadhaar numbers and e-KYC data only in an Aadhaar Data Vault, with keys protected in HSMs, and must answer for the sub-AUAs, agents and vendors who use their access. Video-KYC platforms and identity verification vendors add a newer surface: AI face matching, liveness models, mobile SDKs and cloud video storage that fraudsters probe with deepfakes, virtual cameras and emulators. Each of these components is a point where a control can fail quietly while transactions keep flowing.

4. The trust layer: certificates, eSign and verified documents

Trust services make a digital act legally binding. Certifying authorities licensed by the CCA issue digital signature certificates, operate registration authorities that verify applicants, protect signing keys in HSMs and publish revocation status. eSign service providers, which must themselves be licensed CAs, issue short-lived, single-use certificates on the basis of an Aadhaar e-KYC authentication, so that a borrower, policyholder or employee can sign a document online. Application service providers integrate eSign into their own products, typically as sub-KUAs of the ESP under an agreement and the ESP's onboarding and security terms. DigiLocker carries the same idea to documents: issuers push signed certificates, marksheets and licences into residents' accounts, and requesters fetch them through APIs as documents accepted at par with originals under Rule 9A.

The weakest point in this layer is usually the application, not the cryptography. If an ASP shows the signer a summary but sends a different document hash for signing, or lets a session be replayed, a valid signature can attach to terms nobody agreed to. If a registration authority officer's account is phished, certificates can be issued in other people's names. DigiNotar's collapse in 2011 showed how one intrusion can destroy trust in an entire certifying authority, and the industry's move to shorter certificate lifetimes, with publicly trusted TLS certificates limited to 200 days from March 2026 under CA/Browser Forum rules, means more frequent issuance and more automation to secure. Consent records, document binding, RA controls and key management are therefore core controls, not paperwork.

Highest-risk moments

Onboarding a new sub-AUA, agent network or ASP, launching or changing a mobile app or SDK, migrating an Aadhaar Data Vault or HSM to the cloud, festive and benefit-payment peaks that bring authentication surges, rolling out face authentication or video-KYC at scale, CA key ceremonies and RA staffing changes, integrations with new lenders or DigiLocker requesters, UIDAI or CCA audit cycles, and staff exits from operations with privileged access are where identity and trust incidents typically begin or escalate.

5. The systems behind the products and services

Title: Figure 2: Where cyber risk sits across the identity and signing lifecycle. - Description: Figure 2: Where cyber risk sits across the identity and signing lifecycle.

Figure 2: Where cyber risk sits across the identity and signing lifecycle.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Enrolment and update	Enrolment kits, operator logins, document capture, upload clients	Operator access control, kit integrity, document fraud checks
Onboarding and KYC	e-KYC, offline QR verification, video-KYC, face match	Liveness and injection defences, consent capture, data minimisation
Authentication	Registered devices, AUA and KUA servers, ASA links, OTP services	Device certification, encryption, replay protection, anomaly monitoring
Signing and sealing	ESP signing HSMs, ASP apps, CA and RA systems, timestamping	Document binding, consent logs, RA controls, key management
Storage and sharing	Aadhaar Data Vault, HSMs, DigiLocker APIs, logs and reports	Vault-only storage, tokenisation, masking, API authorisation
Reliance and disputes	Loan, payment and telecom systems, audit trails, evidence stores	Tamper-evident logs, retention, forensic readiness

6. Trends that change the attack surface

Trend	What is changing	Security implication
Face authentication at scale	Face authentications more than doubled year on year by November 2025	Liveness and presentation-attack defences become critical
Private-sector Aadhaar authentication	Approved non-government entities may use Aadhaar authentication from 2025	New requesting entities need audits and vaults from day one
Offline and app-based verification	Signed QR codes and app-based sharing reduce Aadhaar number collection	Verifiers must validate signatures and avoid storing numbers
Deepfakes and injected video	Synthetic faces and virtual cameras target video-KYC	Injection detection, device integrity and agent controls needed
Cloud-hosted vaults and HSMs	Circular 14 of 2025 sets rules for cloud and on-premises hosting	Cloud configuration, key custody and access reviews needed
Shorter certificate lifetimes	TLS certificate validity cut to 200 days in 2026, heading to 47 days by 2029	More automated issuance and key handling to secure

7. Mapping operations to Codec Networks engagements

If the organisation operates…	Recommended starting engagement
Aadhaar authentication or e-KYC as an AUA, KUA or sub-AUA	Role-specific UIDAI assessment against the compliance checklist, vault and HSM review, data discovery for stray Aadhaar numbers
An authentication service agency network	Network and infrastructure VAPT, resilience and failover review, monitoring of authentication links
A certifying authority or eSign service	CA, RA and signing control review, HSM and key management review, CCA audit readiness
An application that integrates eSign	ASP application security assessment, document-binding and consent tests, ESP API testing
Video-KYC, face match or identity verification	Deepfake and injection testing, liveness review, API and SDK testing, fraud monitoring
DigiLocker issuance or document requests	DigiLocker API and integration testing, access and retention review

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by organisation, role in the ecosystem and the agreements in force.