Legal
Privacy Policy
Last updated June 2026
1. Our approach: zero PII at rest
VerifyX is engineered so that user media - document images and selfies - is processed inside short-lived, isolated pods and destroyed once a decision is reached. We do not store photographs, document images, or biometric templates. Only the business customer identifier, the verification outcome, and numeric scores persist.
2. Information we process
For end users: document and biometric media (transiently, in memory only) and the resulting scores. For business customers: account, contact, billing, and onboarding documents (CAC/incorporation, shareholders, signatories) which you provide for KYB.
3. How we use information
To provide verification and screening, to operate and secure the platform, to bill for usage, to meet our own regulatory obligations, and to communicate with you. We do not sell personal data.
4. Legal bases
We process data to perform our contract with you, to comply with legal obligations (AML/CFT), and on the basis of legitimate interests in operating a secure service. You are the controller for your end users.
5. Data residency
Score data is small and can be restricted to a designated jurisdiction. We support African data-residency requirements alongside global coverage.
6. Retention
Verification records are retained for 90 days by default (configurable), then auto-purged. Webhook delivery logs are retained for 30 days. Business onboarding records are retained for the life of the account plus any statutory period.
7. Your rights
Subject to applicable law (including GDPR and NDPR), individuals may request access, correction, or erasure. Because biometrics are never stored, erasure of a verification record is a single anonymising update.
8. Security
TLS 1.3 in transit, AES-256 at rest for the scores database, IAM-scoped secrets with rotation, and no PII in telemetry. SOC 2 scope is limited because there is no media storage to audit.
9. Sub-processors
We use vetted infrastructure and verification vendors behind typed interfaces. A current sub-processor list is available on request.
10. Contact
For privacy requests, contact privacy@verifyx.com or our Data Protection Officer via the Contact page.