How VerifyID handles identity data
What we process, where it goes, how long it stays and how it is protected. Written for the compliance and security teams of the organisations that use us.
Download the compliance pack (PDF) Security overview
Roles
You decide who to verify and why: you are the controller for the people you verify. VerifyID processes their data for you, on your instructions and with your retention settings.
Sub-processors
| Who | What for | What they receive |
|---|---|---|
| Server hosting | Runs the application, database and encrypted files | All service data; images and backups are encrypted |
| Hostinger | Email delivery and the support mailbox | Emails we send and support emails we receive |
| "Sign in with Google", only if a user chooses it | That user's sign-in | |
| Telegram | Internal operations alerts; support chat if a customer contacts us there | Alerts and support messages. Never verification images or document data |
| Anthropic | Translating a support message, only if translation is switched on | The text of that message |
Face matching, liveness, document reading and sanctions screening run on our own servers. No third-party biometric service receives images.
Retention
- Images: deleted right after the decision by default; you can keep them up to 1 year.
- Verification records and face signatures: 90 days by default; you choose 30 days to 2 years.
- Encrypted backups: 14 days.
Security
- TLS in transit; AES-256-GCM at rest for images, attachments and backups.
- Two-factor authentication, role-based access, exportable audit logs.
- Optional two-person approval for manual reviews.
- Nightly encrypted backups that are checked after they are made; monitoring with alerts; a public status page.
Consent and people's rights
Hosted verification pages ask for explicit consent before any capture and keep a record of it (wording version 2026-10-01), which appears in every case report. People can ask for a copy or deletion of their data with the data request form; requests reach your dashboard with a 30-day due date.
What we do not claim
VerifyID does not currently hold a third-party security certification (such as ISO 27001 or SOC 2). If your review requires one, tell us what you need and we will answer your questionnaire directly.