Security and privacy

Verificate handles identity documents, faces and voices for the companies that use it. This page says what it collects, how that personal data is encrypted and protected, who can see it, how long it is kept, and what the checks cannot do.

What is collected, and why

A company chooses which of these steps it needs. The customer is shown what will be collected, and asked for consent, before the camera starts.

Step	What is taken	What it is used for
Consent	The wording shown, its version, the language and the time	A record that the customer agreed, and to what
Identity document	Photos of the front, and of the back for cards	Reading the details, and checking the document is genuine, in date and accepted
Proof of address	Photos, or a file the customer uploads, up to five pages	Reading the name, the address and the date
Selfie	A photo with a few frames around it, or a short clip of head turns	Comparing the face with the document, and checking it is a live person
Selfie with a document	A photo of the face and the document together	Checking the document is held, and is the one that was sent
Video statement	A short video with sound	Checking the sentence was said, at that moment, by the same person
Every session	When each step started and ended, the kind of device and browser	Noticing a pace, a program or a camera that is not a person's

Where it goes

Pictures and recordings go from the customer's phone straight to Verificate's service, and are stored there, encrypted, for the company that asked for them. A company can have its customers' files stored in the European Union.

Verificate's proprietary AI reads the documents, compares the faces, checks that they are live, and listens to the recordings. The part that measures faces keeps nothing: it receives a picture, returns what it measured, and forgets both.

No other verification company sees the pictures, and nothing is sold.

Encryption

On the way: The capture page, the API, the widget and the review desk are served over HTTPS, and webhooks are sent to HTTPS addresses only. Inside the service, storage is reached over TLS.
At rest: Every file, every record and each session's own store are encrypted with AES-256, always and automatically, with keys kept in a managed key store.
Secrets: API keys, link secrets and device secrets are kept only as SHA-256 hashes, so a copy of the database would not reveal them. The secrets that sign webhooks, which have to be read back, are sealed with AES-256-GCM under a key of their own.
Faces: The measurements used to compare a face exist in memory for one comparison. They are never written anywhere.

Who can see it

Only the people a company names, at its review desk. They sign in with single sign-on, through their Google or Microsoft work account.
Viewers see the queue and the figures, but no files and no personal data. Reviewers see files and decide. Administrators manage keys, people, webhooks and erasure.
Opening a file or a customer's details writes an entry in the audit log, before anything is shown.
The company's server reads a session with its API key. The widget on its signup page learns progress only: no names, no pictures, no reasons.
Companies are kept apart in every query, by their keys and by roles.
Logs hold no names, no document numbers and no secrets.

How long it is kept

Every session carries the date on which its personal data is erased. The company sets how long, usually because its own regulator requires a record. Where a customer's country allows less, less is kept.
Every day the service erases the sessions whose date has passed: the pictures and recordings, what was read from them, the details the company sent, what the checks found, and the reviewers' notes. What remains is the record that a verification took place, when, and how it was decided.
A company can erase a session at once, from its server or from the desk, for example when the customer asks.
A session on legal hold is not erased until the hold is lifted.
Measurements of a face are never kept at all.

Other protections

The secret in a customer's link is in the part of the address after #, which browsers do not send to servers. It is in no access log and no referrer.
A link works for one session, and belongs to the device that starts it.
Files are never public. Every read goes through the service, which checks who is asking.
Uploads are checked by their first bytes rather than by what they claim to be, and limited in size.
The capture page has a strict content security policy, cannot be framed, and asks for the camera only where a step needs it.
Webhooks are signed with the time they were sent, so an old one cannot be replayed.
Requests are limited for each key, each session and each address.

What the AI is not asked

Whether a document was generated. The AI that reads documents cannot tell reliably, and is not asked. It reports what it sees instead: the pixels of a screen, the edge of a photocopy, a field printed in a different typeface from the ones around it.
Who someone is. A face is compared with the document the customer sent, and with nothing else.
What the sentence was. The recording is written down without it, and the comparison is made afterwards.
To follow what a document says. Words from a document, a company or a customer are treated as data, never as instructions.

What it cannot do

These are limits of the approach, not faults waiting to be fixed.

Tell every generated face from a real one. No detector can, reliably: detectors trained on last year's generators miss this year's. The defence is many signals that are each hard to fake, and a person for every doubt.
Fully stop video being fed in place of a camera. A web page cannot. The signals collected make it harder and more expensive. Only an app that the phone itself vouches for can close this completely.
Match every face with certainty. Small, laminated portraits are the hardest to compare. The band between a pass and a fail is wide for that reason, and whatever falls in it goes to a reviewer.

Reporting a problem

If you find a security problem, write to security@verificate.io. Please give us the time to fix it before you tell anyone else.