Onboarding Limited — NZ Employment Credential Platform

Platform initialised in accreditation-track mode. All transactions are logged with consent references. Data residency: NZ (AWS ap-southeast-2). No credentials have been issued yet — this is your clean-start baseline.

Credentials Issued

0

Ready to issue

● System ready

Active Holders

0

Workers / entities

● Wallet integration ready

Accreditation Readiness

74%

6 items outstanding

⚠ In progress

Audit Log Entries

12

System events captured

● Tamper-evident

TFA Accreditation Progress

74%

ready

✓

Company registered — Onboarding Limited

NZ Companies Register · March 2026

✓

W3C VC 2.0 technical stack built

SD-JWT VC · EdDSA · did:web · Bitstring Status List

✓

Credential schemas defined (NZ Employment, H&S, Trade)

JSON-LD context published · GitHub

✓

Consent recording system operational

Per-transaction consent log · Privacy Act 2020 aligned

✓

Audit log — tamper-evident, immutable

All issuance, verification, revocation events captured

→

Contact TFA — pre-application engagement

TFA@dia.govt.nz · Schedule within 30 days

→

Privacy Impact Assessment

Draft complete · Independent review needed

○

Independent security evaluation

Commission TFA-approved evaluator

○

Independent privacy evaluation

Commission TFA-approved evaluator

○

Submit TFA accreditation application

Target: Q3 2026

Credential Types Available

NZ Employment Agreement

Employer signed · NZBN anchored

Ready

H&S Certification

WorkSafe NZ / Site Safe aligned

Ready

Trade Licence

EWRB / PGDB / LBP registry wrapper

Ready

IRD Identity Anchor

RealMe verified identity binding

Pending

Data Residency

✓ NZ Only

All credential data, keys, and audit logs processed and stored exclusively within New Zealand jurisdiction (AWS ap-southeast-2). No personal or organisational information transmitted outside NZ. Meets DISTF requirement for data sovereignty disclosure.

REGION

ap-southeast-2

PROVIDER

AWS / Mattr VII

Credential Type

Employment Agreement

Employer issued · NZBN anchored

H&S Certification

WorkSafe / Site Safe

Trade Licence

EWRB / PGDB / LBP

Identity Anchor

RealMe verified binding

Holder Full Name

IRD Number

Employer / Org Name

NZBN

Employment Type

Start Date

Role / Position

Pay Band

VC 2.0 Preview

SD-JWT

// W3C Verifiable Credential 2.0
// Secured: SD-JWT (VC-JOSE-COSE)
// Issuer DID: did:web:onboarding.nz

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://onboarding.nz/contexts/employment/v1"
  ],
  "type": ["VerifiableCredential", "NZEmploymentCredential"],
  "issuer": {
    "id": "did:web:onboarding.nz",
    "name": "Onboarding Limited"
  },
  "validFrom": "2026-03-15T00:00:00Z",
  "credentialSubject": {
    "id": "did:key:z6Mk...",
    "holderName": "—",
    "employerName": "—",
    "nzbn": "—",
    "employmentType": "permanent",
    "role": "—",
    "startDate": "—"
  },
  "credentialStatus": {
    "type": "BitstringStatusListEntry",
    "statusListIndex": "0",
    "statusListCredential": "https://onboarding.nz/status/1"
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-rdfc-2022",
    "proofPurpose": "assertionMethod",
    "verificationMethod": "did:web:onboarding.nz#key-1"
  }
}

Selective disclosure: Holder can present employment status without revealing IRD number, pay band without revealing role, or any subset of claims. Zero personal data shared beyond what the verifier requests.

The Trust Framework Register currently has zero accredited providers. Being first on the register is a significant commercial and trust signal. Target submission: Q3 2026.

Technical Readiness

92%

VC 2.0 · SD-JWT · DID · Status List

Governance Readiness

65%

PIA drafted · Evals outstanding

Operational Readiness

70%

Audit log live · Security plan needed

Technical Standards

92%

✓W3C VC 2.0 data model compliant
✓SD-JWT VC format (VC-JOSE-COSE)
✓EdDSA / eddsa-rdfc-2022 cryptosuite
✓Bitstring Status List v1.0 for revocation
✓did:web issuer DID published
✓OID4VCI issuance protocol
✓OID4VP presentation protocol
✓Selective disclosure — attribute-level
~ISO 18013-5 mDL support (optional path)
~Credential format questionnaire — drafted

Privacy (Privacy Act 2020)

68%

✓Consent recorded per transaction (Rule 10)
✓Data minimisation — selective disclosure native
✓No phone-home verification (Rule 27)
✓No cross-issuer tracking or correlation
✓NZ data residency — AWS ap-southeast-2
~Privacy Impact Assessment — drafted, not reviewed
~Te ao Māori data governance consideration
✗Independent privacy evaluation — not commissioned
✗Privacy evaluator appointed (designated person)

Security & Risk Management

70%

✓Cryptographic key management (HSM-backed)
✓Key rotation policy defined
✓Tamper-evident audit log
✓Credential revocation within 24hrs
✓Data breach response procedure drafted
~Security risk assessment — in progress
~Security management plan — drafted
✗Independent security evaluation — not commissioned
✗Penetration test — not completed

Identification Management

80%

✓NZ Identification Standards awareness
✓RealMe verified identity as identity anchor
✓NZBN employer verification integrated
✓Holder binding — cryptographic (DID key)
~ID management evaluation — prepare for DIA
✗Independent ID management evaluator — not engaged

Governance & Operations

60%

✓Company registered — Onboarding Limited
✓Information governance plan — drafted
✓6-monthly reporting template prepared
✓DINZ membership — targeted
~TFA pre-application contact — scheduled
✗Designated privacy officer appointed
✗TFA application form — not started
✗Accreditation mark agreement — pending

Consent & Authorisation

95%

✓Per-transaction consent capture (Rule 10)
✓Consent recorded with timestamp + txn ref
✓Only subject can authorise presentation
✓No consent bundling for unrelated activities
✓Consent records immutable, audit-linked
✓User informed of all data collected
✓Consent withdrawal mechanism available
~Consent UI copy — legal review needed

System Event Feed

● Live