Data practices

How identity data is processed, retained, secured and deleted across our global verification layer.

Scope of processing

We process data required to complete identity verification sessions for e-passports, e-ID cards and wallet credentials, and to return personal data and verification outcomes to our customer.

Retention and deletion

The data is processed and retained only for the lifetime of the session, up to one hour. When the session ends or expires, associated data is deleted.

Security commitments

The data is encrypted in transit and at rest. Session controls and retention limits are used to restrict data exposure and lifecycle duration.

Storing identity or verifying on demand

Our model is built around short-lived verification sessions and minimal retention. The goal is to verify cryptographic identity evidence when needed, rather than keep long-lived stores of raw identity data.

GDPR role

We act as a data processor under GDPR and processes personal data on behalf of the customer, who acts as the data controller.

Legal documentation

See our Data Processing Agreement (DPA) and Privacy Policy for contract and policy context.