# Data practices

## How identity data is processed, retained, secured and deleted across our global verification layer.

### Scope of processing

We process data required to complete identity verification sessions for e-passports, e-ID cards and wallet credentials, and to return personal data and verification outcomes to our customer.

### Retention and deletion

The data is processed and retained only for the lifetime of the session, up to one hour. When the session ends or expires, associated data is deleted.

### Security commitments

The data is encrypted in transit and at rest. Session controls and retention limits are used to restrict data exposure and lifecycle duration.

### Storing identity or verifying on demand

Our model is built around short-lived verification sessions and minimal retention. The goal is to verify cryptographic identity evidence when needed, rather than keep long-lived stores of raw identity data.

### GDPR role

We act as a data processor under GDPR and processes personal data on behalf of the customer, who acts as the data controller.

### Legal documentation

See our [Data Processing Agreement (DPA)](/content/dpa/index.html) and [Privacy Policy](/content/privacy/index.html) for contract and policy context.