Nevis ID

Nevis ID is an identity and access management service for an organization's external users: Customer IAM (CIAM) for consumers and citizens, and Partner IAM (PIAM) for the users of partner organizations. Customers and partners are its two user constituencies, distinct populations that each need their own flows and administration model. Customers consume the organization's products and services. Partners contribute work, services, or supply-chain interactions. A partner organization, whether supplier, distributor, broker, or contractor, is itself a managed entity, modeled as a recursive organizational unit with cross-application enterprise roles and its own delegated administrators. Applications delegate registration, authentication, and profile management to Nevis ID and connect to it as relying parties over OpenID Connect, OAuth 2.0, or SAML 2.0.

Scope

This documentation covers Nevis ID, the SaaS product hosted on Microsoft Azure. The software-delivered Identity Suite and the Authentication Cloud are separate products with their own documentation.

Relationship Models

Customers and partners connect to the organization running Nevis ID in different modalities.

Model	Modality
B2C	The organization serves consumers directly
B2B	Partner organizations and their users work with the organization
B2B2C / B2B2E	An intermediary business (a dealer, broker, franchise, or reseller) manages access for its own customers (B2B2C) or employees (B2B2E); the organization has no direct relationship with those end users
G2C	A government agency serves citizens

Capabilities

• Authentication, MFA, and passwordless. Passkeys (FIDO2/WebAuthn), FIDO UAF, push approval and transaction confirmation (FIDO UAF WYSIWYS) through the Nevis Access App or the Mobile Authentication SDK, cross-device login via QR code or push, TOTP, OTP over email and SMS, passwords. Account recovery uses OTP channels, recovery codes, account linking (Google, Microsoft, Apple), or E-ID based flows.
• Federation and SSO. Nevis ID acts as OAuth 2.0 authorization server, OpenID provider, and relying party, with authorization code plus PKCE, client credentials, and refresh token flows, pushed authorization requests (RFC 9126), dynamic client registration, and JWKS based key rollover. SAML 2.0 is supported in both IdP and SP roles with SP and IdP initiated SSO and single logout. WS-Federation and BYOI with social providers or corporate IdPs are also supported.
• Registration, onboarding, and identity verification. Self-service registration with separate flows per user type, a graph-view flow editor with templates, support for long-running processes such as onboarding with on-site identification, progressive profiling, and device registration. User communications use multilingual templates over email and SMS. Identity verification runs through integrated providers (for example, Signicat) or E-IDs like the Swiss E-ID or the EUDI Wallet.
• APIs, provisioning, and integration. REST APIs versioned with the deployed Nevis ID release, inbound and outbound SCIM, bulk import, and just-in-time creation on first federated login. API clients authenticate with an API key issued to a service account.
• Deployment, architecture, and data residency. A dedicated, isolated instance per customer on Microsoft Azure with regional data residency and separate TEST and LIVE environments. Details under Deployment and Isolation below.
• Reporting and audit. Statistics for registrations, logins, MFA usage, consent, and recovery; a User 360 view covering profile, credentials, devices, active sessions, and event history; real-time dashboards with detection of brute-force and new-account-fraud patterns; a history-enabled data model that records every administrative change with actor and timestamp; append-only audit logs with critical events retained for 180 days; log and event export for SIEM ingestion or longer archival.
• Multi-tenancy and delegated administration. Tenants isolate user populations. Datarooms scope what a delegated administrator can see. Delegation follows the unit hierarchy with no fixed depth limit, and you control which rights are delegated. Delegation patterns cover B2B partner administrators as well as family scenarios such as parents managing accounts of minors.
• Consent and privacy. Versioned terms and conditions per application, consent objects carrying version and acceptance date available over the API for audits and compliance, configurable re-acceptance on change, and data subject requests fulfilled self-service or over the API.
• Risk and adaptive access. Nevis ID correlates IP reputation, geolocation, geo-velocity, and device signals into a risk score that drives step-up authentication, notification, or blocking, with predefined risk profiles and support for custom profiles. Credential intelligence checks flag breached credentials, and suspicious logins trigger user notifications with a one-click option to terminate the session and block the device. Third-party fraud platforms connect through extension points.
• B2B and organization management. Organizations are modeled as recursive units with cross-application enterprise roles and delegated partner administration. Organization users can be provisioned just in time over SCIM, REST, or social/OIDC (including bulk loading over SCIM), and partner organizations can bring their own IdP over OIDC or SAML.
• E-ID, wallets, and verifiable credentials. Verifier integrations for the Swiss E-ID (swiyu), Signicat, and walt.id, with just-in-time account creation and account linking to bind a verified e-ID to a Nevis ID account.

Standards and Certifications

• Supported Protocols: OpenID Connect, OAuth 2.0 (including PKCE and PAR, RFC 9126), SAML 2.0, SCIM 2.0, JWT, WS-Federation, FIDO2/WebAuthn, FIDO UAF.
• Certifications: OpenID Connect certified, FIDO certified, ISO 27001, SOC 2 Type II.

Deployment and Isolation

Nevis ID runs as SaaS on Microsoft Azure. Each customer runs in a dedicated instance: a separate Azure resource group with its own Kubernetes cluster and PostgreSQL database. The instance is not shared across customers. The analytics layer is shared per Azure region, isolated by filtering. Within an instance, TEST and LIVE environments are provided by default, and configuration changes can be promoted between them.

Dedicated regions include Switzerland, Germany, France, the EU, the UK, US East and West, and Southeast Asia; additional regions are available on request, subject to Azure capacity. Data at rest, including logs and backups, stays in the selected region. Operational telemetry for service-level objectives is processed outside it and carries no personal data.

Security and Compliance

TLS termination, web application firewall, and DDoS protection run on Cloudflare. Nevis is ISO 27001 and SOC 2 Type II certified and operates under GDPR, CCPA, and Swiss data protection law. Independent penetration tests run regularly; reports and audit summaries are available on request. Subprocessors (Microsoft Azure, Cloudflare, and optional providers for email, push, and app attestation) are documented with scope and processing locations.

Where to Start

• Developers: start with how to use the API.
• Evaluators: read the system overview for architecture and components.

Common questions are collected in the FAQ; for anything else, contact support.