Biometrics
The face check runs on the candidate's device. Face images, video and face templates are never uploaded or stored.
On the device
The camera image is read on the candidate's phone or computer to find head pose, read the ID and compare the face with the ID photo. No frame is uploaded.
What the server receives
- Each head turn's timing, size and brightness, so the server can check the run was live and in the order it asked for.
- The face match distance, from which the server decides the match.
- One-way codes of the document number and of each word of the name, which the server keys again before storing.
- The ID's country and kind, how it was read, and whether it has expired.
- The device's hash and timezone, and the network address, as at apply.
Not the image, not the video, not a face template and not the document number.
When it is destroyed
| Data | Destroyed |
|---|---|
| Head turn measurements | After 30 days |
| The verification result and its codes | 30 days after the 12-month check expires, at once when consent is withdrawn, on account deletion, and never later than 3 years |
| An ID photo sent for review | When a reviewer decides, or within 30 days |
| The day one face result | After 3 years |
| Reviewer decisions | Kept with the candidate, as the record of who decided what |
A daily job at 03:00 UTC applies the schedule. Withdrawing consent deletes the identity at once, without waiting for it.
Consent
Written consent is recorded before any capture, with the notice's version, and anyone can choose a person reviewing their ID instead. See consent and the biometric data retention policy.