> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/help-center/integrations/compliance-guardrails.md).

# Compliance Guardrails

Custom branding must not change how the gateway meets UIDAI and CCA requirements.

## Must remain unchanged

* The **eMudhra ESP identity** and the gateway's eMudhra domain in the browser address bar — pages must not be hidden inside an iframe that masks the URL.
* **Consent text** for eKYC, certificate issuance and signing, and the explicit consent action.
* **Document information** (`docInfo`, and `docUrl` for v3) shown to the signer before consent.
* Aadhaar / VID entry with masking, OTP, PIN and biometric capture components and their wording required by UIDAI.
* Error and timeout messages that tell the signer what happened.

## Not allowed

* Custom or third-party **JavaScript**, analytics, tracking pixels or session-recording tools.
* Styles that hide, shrink or obscure consent, document details, legal text or the ESP identity.
* Pre-filling or capturing Aadhaar numbers, OTPs, PINs or biometrics in ASP systems.
* Assets served over plain HTTP or from unregistered domains.

## Recommended

* Keep CSS minimal and versioned; use SRI hashes.
* Ensure accessible contrast and mobile responsiveness.
* Test every authentication mode (OTP, T-OTP, fingerprint, iris, face) after branding changes.

{% hint style="warning" %}
**Review before publishing:** validate these guardrails with eMudhra compliance against current UIDAI AUA/KUA and CCA eSign guidelines.
{% endhint %}