Security at VerifyHuman

What we store

• Never: face images, video, audio, or a respondent’s name.
• Deleted within 24 hours: the raw landmark data received from the browser.
• Kept, with defined retention: a derived geometric fingerprint used only to detect repeat verifications, plus network and device signals used for fraud detection. Full schedule in the Privacy Policy.
• Consent: shown on screen before the camera starts and recorded with each verification. A silent check (no camera, no face data) is also available.

How it is protected

TLS on every endpoint. Encryption at rest on all databases, with application-level envelope encryption of keys and secrets under a rotating master key. Row-level tenant isolation in the database and an authorization check on every API endpoint, both enforced by automated tests on every build. API keys and passwords stored hashed only. Append-only audit logging. Daily backups with a standby database and redundant application instances. Production access limited to named engineers. A written incident-response procedure with customer notification within 72 hours of a confirmed personal-data breach.

Where it lives

Customer and verification records are hosted on DigitalOcean in New York, United States. The anonymous vector index used for duplicate detection runs on Zilliz Cloud in Frankfurt, European Union. EU customers are supported under Standard Contractual Clauses; full EU data residency is on our roadmap. Enterprise customers can ask for a private or on-premise deployment instead.

Subprocessors

DigitalOcean (hosting), Auth0 (login), Stripe (payments), Resend (email) and Zilliz (anonymous vector index). Machine-readable list with data categories and 30-day change notice: /legal/subprocessors.json.

Third-party reference data

Network classification uses open IP-address reference databases published by ip-location-db: IP-to-country data from DB-IP, licensed under CC BY 4.0, and IP-to-ASN data from the same publisher. These describe network address ranges only. They are never combined with, and contain no, personal data.

Compliance and reviews

We complete standard vendor questionnaires (SIG Lite, CAIQ, or your own) and walk reviewers through our controls on request. SOC 2 preparation is underway, with controls mapped to the Trust Service Criteria. A Data Processing Agreement with EU Standard Contractual Clauses is in preparation. Data-subject requests: [email protected]. Vulnerability reports: [email protected] (see security.txt).