Trust

Security and data protection

Identity data is some of the most sensitive data there is. We collect as little as we can, keep it for as short a time as we can, and protect it at every step.

We keep images for minutes, not years

• Document and selfie images are deleted as soon as the result is decided.
• If a user leaves without finishing, their images are deleted within 24 hours.
• We do not keep face templates after the check, and we never build a face database.
• What stays in your account is the result: the decision, the check outcomes and the data read from the code lines. You can delete it at any time.

Live capture blocks the easy fraud

• There is no upload button. Documents and selfies come straight from the camera, so edited or downloaded images cannot be used.
• Active liveness asks the user to turn their head, and passive checks look for printed photos, screens and masks.
• Check digits in the code lines catch changed numbers and dates.

Protected in transit and at rest

• Every connection uses HTTPS with modern TLS and HSTS.
• Stored results are encrypted at rest.
• Verification links are single-use, unguessable and expire after 24 hours.

Built for safe integration

• Separate test and live keys. Live keys can be revoked and replaced from the dashboard at any time.
• Every webhook is signed with your secret and a timestamp, so you can reject fakes and replays. See webhooks.
• The verification page cannot be framed by other sites, which blocks click-jacking.

Access and infrastructure

• Runs on Cloudflare's global network, with DDoS protection in front of every request.
• Staff access to customer data is limited to what is needed for support.
• We never sell identity data or use it to train models for other purposes.

Your users' rights

People being verified are told what happens to their data before they start, and must agree first. Read the Biometric Data Notice and the Privacy Policy for the details.

Report a security issue

If you think you have found a vulnerability, please tell us through the contact form with the word "Security" in the message. We will reply quickly and keep you updated until it is fixed. Please do not test against other customers' data.