Building an EU Digital Identity (EUDI) Wallet? Its certification is issued by an accredited body, against attackers with high capability. We find the vulnerabilities and test it that way first, so you reach that evaluation ready.
Under eIDAS 2 (Regulation (EU) 2024/1183), every Member State must offer an EU Digital Identity (EUDI) Wallet, often called the eIDAS wallet. Implementing Regulation (EU) 2024/2981 sets how wallet solutions are certified, with the cybersecurity part anchored to the EUCC scheme and aimed at a high level of assurance.
Wallet solutions must be certified by accredited conformity-assessment bodies designated under the Member State schemes. vulnit is not such a body, so we do not certify your wallet.
What we do is the work before that: a pre-evaluation of the wallet app. We find the vulnerabilities and test it against attackers with high attack potential, the level the certification expects, so you reach the accredited body with them fixed rather than discovered during the evaluation, where they would cost you time.
A wallet holds a person's identity and the credentials they present to the world, so we attack it the way a high-capability attacker would. Depending on your solution, testing can cover:
States what we tested: the wallet app on each platform, the build and the flows in scope. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and, where they apply, OWASP MASWE references, and how to fix it.
Covers the scope and build tested, the results and the priorities, for management and non-technical readers.
If you include the retest, we send a new version of the report with the status of each finding on the new build, before you submit your wallet to the accredited body.
On request, at no extra cost, we provide a signed letter with what we tested, the version, the date and the result, for your customers or auditors. After the retest, we update it with the new results.
Our team comes from security certification laboratories, with hands-on experience in Common Criteria, the Spanish LINCE scheme and mobile payment standards such as EMVCo SBMP. Wallet certification leans on EUCC, so we know how its vulnerability analysis and high attack potential are applied.
Our team contributes to OWASP Mobile Application Security, the main reference for testing mobile apps. OWASP recognized this work by naming vulnit an OWASP MAS Advocate.
We explain how to fix each finding and, if you include the retest, check the fixes before you submit your wallet to the accredited body.
Meet the teamThe EUDI Wallet is a mobile app, introduced by eIDAS 2 (Regulation (EU) 2024/1183), that lets people store and present identity data and electronic attestations across the EU. Wallet solutions have to be certified before they are offered.
No. Wallet solutions are certified by accredited conformity-assessment bodies designated under the Member State schemes, with the cybersecurity part anchored to EUCC. We are not such a body. We perform the pre-evaluation so you reach that process ready.
Probably not. The certification burden falls on the wallet solution itself, not on a relying-party app that uses one. For a relying-party app, a standard mobile application penetration test is the right fit.
At the wallet's high assurance, the evaluation expects design and implementation analysis, so we include a source code review alongside the black-box testing. We agree the exact scope with you.
When needed. On Android we mainly work with Chameleon, our analysis environment: it gives us deep visibility into what the wallet does in the operating system, and handles root, pinning and anti-instrumentation checks at the OS level by default. On iOS we test on physical devices.
The wallet builds, the target assurance and schemes you are certifying against, test accounts and access to the issuance and verification environments in scope, and the source code for the high-assurance review. The proposal sets out the details.
We agree confidentiality terms before you share builds, documentation or source code. We have a standard NDA, but if you prefer to use yours, we are happy to review it.
Tell us about your wallet and your certification date. We reply within one business day to arrange a scoping call.
Talk to our team