Trust
Data protection overview
You decide what is collected, how long it is kept and when it is erased. This page explains the controls.
Roles
When you send your users' data to the services for verification, we generally act as your processor, on your documented instructions. You, as the business customer, are generally the controller. The privacy policy describes the roles in full.
The data lifecycle
Collect
Only what the scenario asks. In the scenario editor you choose the steps, the documents and the countries, so a session collects what your flow needs and no more.
Protect
- IP allowlist for API access.
- Roles and a login log in the dashboard.
- Token expiry for API tokens.
- Encrypted callback body for webhooks, or callbacks that can omit names, document data and images and keep the session identifier, which links to the session.
Verify
Document, face and liveness checks run in one session, as described on the platform page.
Store
Retention is a setting you choose per scenario. Sessions keep their data for the period your scenario sets.
Delete
Erasure is available on request through the API.
- The erase call destroys the personal data of one session, or of every session of one end user: document data, contacts, images and video, and the person record that the session created, unless another session or a manual entry still holds it.
- The session itself stays, with its verdict.
- A cause is recorded for every erasure, for example
subject_requestorconsent_withdrawn. - When the destruction completes, a
PD_ERASURE_COMPLETEwebhook confirms it. - An erasure log lists what was destroyed, when, why and by whom, for a period you choose.
Callbacks that omit identity fields
Webhooks can carry the body encrypted, or omit names, document data and images. In the second mode the callback keeps the session identifier, which links to the session, and your system fetches the result by that identifier after the event arrives. See the webhooks documentation.
Deployment
Run on our cloud, or have our engineers install the platform on your own servers.
Policies
Read the information security policy, the privacy policy and the terms of use.