In digital services, establishing someone’s real-world identity, authenticating an account, and deciding what that account may do are separate tasks. Before calling someone an identity-verified customer, a startup should understand which check happened and what its application actually receives.
This guide explains the vocabulary behind digital identity verification, then shows where Gammal Tech’s account model fits. Gammal Tech requires a national-ID check for each account and allows one account per person. Participating applications use account authentication without receiving the person’s identity information.
What does digital identity verification mean?
Digital identity verification is the process of establishing that a person using an online service corresponds to a claimed real-world identity. The evidence, checks, and confidence involved depend on the process being used.
For a precise identity proofing definition, NIST’s Digital Identity Guidelines describe establishing a connection between an online subject and a real person to a degree of assurance. Proofing is the broader process; verifying that the applicant owns the evidence is one of its outcomes.
A useful product requirement names the intended result. “Let customers return to their saved work” describes account continuity. “Establish the customer’s legal identity” describes an identity requirement. “Allow this customer to manage an organization’s billing” describes a permission. Treating all three as “verification” makes it harder to select the right service.
How identity proofing works
NIST’s proofing overview separates three checks, followed by enrollment:
- Resolution: distinguish the claimed person within the population the service handles.
- Validation: check the evidence and identity information for authenticity, accuracy, and validity.
- Verification: establish that the person presenting the evidence is its rightful owner.
- Enrollment: create the subscriber account and connect suitable ways of authenticating to it.
Remote identity proofing takes place away from a provider-controlled location. It may involve an attended interaction or an automated process; the word “remote” alone does not describe the strength of the checks.
These stages provide a vocabulary for understanding identity services in general. They do not establish which methods Gammal Tech uses, or imply that participating applications can request identity evidence or verified attributes. In a product discussion, ask for the actual enrollment policy instead of inferring it from labels such as “verified,” “digital,” or “secure.”
Identity proofing, authentication, and permissions answer different questions
NIST’s authentication guidance focuses on control of authenticators associated with an account. A later sign-in can therefore provide continuity with that account without repeating the original identity proofing.
| Decision | Question | Example |
|---|---|---|
| Identity proofing | What connects the claimed identity to this person? | Evidence is evaluated during enrollment. |
| Account authentication | Does this visitor control access to the account? | A returning member completes sign-in. |
| Session validation | Is the current account session still valid? | The application confirms its signed-in state. |
| Product authorization | What may this account do here? | A paid member can open their purchased material. |
For example, a signed-in customer may have permission to view their own booking but no permission to view another customer’s booking. Adding an identity check would not, by itself, decide that access rule. Your product still needs to make and enforce the appropriate permission decision.
Where reusable verified accounts fit
Gammal Tech requires a national-ID check for every account and applies a one-account-per-person policy. Duplicate accounts are not allowed. This connects the account to a real person while allowing participating websites to authenticate the account without collecting the identity documents themselves.
Developers cannot request or retrieve the user’s phone number, email address, legal identity, identity documents, or other identity information held by Gammal Tech. Account authentication provides a session token and a way to confirm the session; it does not provide identity attributes or an identity-proofing report. The API reference describes the account and session interface.
Application data access is limited to information the application already knows and has stored within its own scope. For example, an application can save and retrieve its own workspace preferences or learning progress. It cannot use authentication or storage features to look up information from the user’s Gammal Tech identity or obtain information it has not itself stored.
A later valid session authenticates access to the existing account. It does not mean a new national-ID check occurs at every sign-in. The one-account policy also does not establish that every action by an authenticated account is authorized or free of fraud.
Confirm supported enrollment coverage and expected activation timing before planning a launch. This guide does not establish an instant activation promise or a specific waiting period. The customer identity verification guide explains how to build onboarding around these account and data boundaries.
What verified account access establishes for your product
Use “verified” with a clear object: verified account access, verified identity, verified qualification, or verified business authority. Those labels should not be interchangeable in your interface.
Consider a professional community. A national-ID-verified account would not establish that its holder has a particular professional license. A marketplace might authenticate account access and still need to decide whether that account can publish listings. A business portal might require an invitation before an account can view company material.
These are different product facts. Record and explain them separately, and avoid a single badge that implies more than the evidence supports. A workspace preference or a saved progress record belongs to your application’s own data; neither is an identity attribute supplied by Gammal Tech.
Keeping identity-document collection outside your application reduces the document handling your business undertakes. Your own application data and access decisions still require care. The account model does not create immunity from security incidents or remove your responsibilities for the information your application stores.
Define the requirement before selecting the integration
Write one sentence describing the customer action you want to support. Then ask four questions:
- What fact do we need? Account continuity, a verified legal identity, and permission to act for a business are separate requirements.
- What does the service return? Gammal Tech provides account authentication, not the user’s identity attributes or documents. Other identity services may offer different outputs; do not assume those capabilities are available through Gammal Tech.
- Who makes the access decision? Specify which product feature becomes available and what additional conditions apply.
- What data does our application already hold? Define the preferences, progress, or workspace settings your application needs to store and retrieve within its own scope. Account access does not unlock other information held by Gammal Tech.
For a saved-work application, a clear requirement might be: “An authenticated customer can return to their own saved workspace.” For a supplier portal, it might be: “An invited account can access the documents assigned to its organization.” Each statement is easier to implement and evaluate than “all users must be verified.”
When comparing options, use the identity proofing services guide to distinguish document-checking services from access through an existing account.
Common questions
Is email verification the same as digital identity verification?
No. Confirming access to an email address does not by itself establish a person’s legal identity. Describe the completed check accurately: verified email access and verified real-world identity are different claims.
Does a successful sign-in repeat identity proofing?
Not by itself. Sign-in authenticates access to an account. A separate identity-proofing event requires its own process and evidence; it should not be inferred from a new session token.
What user information can my application retrieve from Gammal Tech?
Your application can retrieve information it already knows and has stored within its own application scope, such as saved progress or preferences. It cannot request or retrieve the user’s Gammal Tech-held email, phone number, legal identity, identity documents, or other identity information. A session token does not grant access to unprovided information. Every Gammal Tech account requires a national-ID check, and the policy allows one account per person.
Does this guide establish a NIST assurance level for Gammal Tech?
No. NIST is used here to explain terminology. The references do not establish a certification, a particular assurance level, or suitability for a regulated identity-verification requirement.
References and further reading
- Gammal Tech API and SDK reference — Account privacy, application data scope, and session behavior.
- NIST SP 800-63A-4: Introduction — Identity proofing definition and expected outcomes.
- NIST SP 800-63A-4: Identity Proofing Overview — Resolution, validation, verification, enrollment, and proofing types.
- NIST SP 800-63B-4: Introduction — Account authentication and control of authenticators.