Skip to main content
Revision: 2026-10-13.

​
Establish the workspace

Register the organization’s account and country. Identify the workspace owner and intended administrators. Use sandbox for initial integration and retain separate credentials for production. Do not share a staff account with business users. Submit the required identity or organization evidence through onboarding. Platform staff review the evidence and decide the applicable issuer trust classification. Registration, document upload, country verification and production approval are separate actions; one does not imply that all others have passed.

​
Configure access

Connect SSO for the organization’s own identity provider using the Console configuration. Validate sign-in, membership assignment, sign-out and revoked access before rollout. Configure authenticator-based MFA where available and keep recovery procedures under the organization’s access policy. Workforce-wide enforcement and periodic access-review evidence must be assessed explicitly.

​
Prepare billing

Staff must verify the registered billing country from submitted evidence before new paid billing is enabled. Country changes require review. Available providers and regional pricing follow the account’s verified country. Do not assume that a provider shown in a directory supports every local payment method or that an existing subscription is automatically migrated.

​
Accept the intended workflows

Test issuance, verification with original payloads, expiry, revocation, webhook handling, failures and retries in the selected environment. Confirm API permissions, workspace boundaries and integration credentials. For automation, inspect actual completed or failed workflow outcomes rather than treating an accepted request as successful execution. Store current technical specifications and security documents in the workspace vault. Keep acceptance results, owners, dates and corrective actions. Use this library to understand behavior, then verify the deployed behavior relevant to your implementation.

​
Security review materials

Prepare an approved system scope, risk treatment, access review, incident response procedure, recovery test, vendor review and data-retention requirements. Technical templates do not establish completed controls or operating history. Any SOC 2 or ISO 27001 representation should be supported by the applicable controls and genuine evidence.