Skip to main content

Data Retention & Privacy

Verifik provides configurable data retention policies and automated purge mechanisms to help organizations comply with global privacy regulations, including GDPR (General Data Protection Regulation), Colombia Ley 1581 (Habeas Data), and ISO 27001 data minimization standards.

With granular per-media retention controls, organizations can store images for the minimum necessary duration, redact Personally Identifiable Information (PII), encrypt sensitive extracted data, and execute permanent deletions via API or automated background jobs.

Key Features​

Granular Retention Modes

Choose between store, ephemeral, and none per document type and media category.

Encrypted OCR & PII Masking

Credit-card style masking for dashboard reviews, with AES-256-GCM encryption for automated government matching.

Automated Purge & Redaction

Scheduled background workers delete DigitalOcean Spaces objects, unset PII, and record tamper-evident audit logs.

Right to Erasure (GDPR)

Dedicated single-record and bulk erasure endpoints permanently delete images and identity fields upon request.

Webhook Hold Windows

Guaranteed 24h to 72h safety floor to ensure webhook deliveries and retries complete before purging data.

Isolated Spaces Storage

All KYC uploads are isolated by client and project IDs under strictly scoped hierarchical keys.

Retention Modes​

Verifik supports three operational storage modes configured at the account, project, or project flow level:

ModeBehaviorBest Used For
storePersists files in DigitalOcean Spaces for a specified duration (retentionHours). If retentionHours is not set, files are kept indefinitely until policy change or manual deletion.Long-term auditing, KYC re-verification, regulated banking compliance.
ephemeralRetains images temporarily during the active session. Once the webhook is delivered or the session reaches a terminal state (plus the webhook hold window), objects are purged.Short-term verification where downstream systems archive the assets.
noneZero-storage mode. Document scans are processed in-memory. Image files are not permanently stored in DigitalOcean Spaces. Results are returned synchronously to the caller.High-security, strict GDPR compliance, zero-persistence requirements.

Granular Media Types​

Retention settings can be customized per media type:

  1. documentImages: Front and back document photos captured during scanning.
  2. faceImages: Facial photos and selfies captured during biometric enrollment and liveness checks. (Note: During active enrollment sessions, temporary face images are kept until the comparison completes).
  3. ocrExtraction: Text data extracted from the document.
  4. documentLiveness: Physical document presence photos and tilt analysis frames.

OCR Masking & AES-256-GCM Encryption​

To balance compliance and operational review capabilities, Verifik employs a two-tier OCR security model:

  1. Unmasked Root documentNumber: The top-level document number is stored in clear text to maintain database indexing, exact user lookup, and audit reconciliation.
  2. Masked Presentation (OCRExtraction): PII fields within the extraction (e.g. document number, names, address) are masked credit-card style (e.g., 10****2104|RS**DLXD or JU*N MI***L). This enables human reviewers in Smart-Agent to identify the document without exposing full personal data.
  3. AES-256-GCM Encryption (encryptedOcr): The complete raw OCR payload is encrypted using the client/system RETENTION_PRIVATE_KEY with a random 12-byte initialization vector (IV) and authentication tag.
  4. On-Demand Decryption: Verification steps such as nameValidation and government lookups (colombia_api_identity_lookup, getCitizenByCountry) decrypt the payload in-memory on demand to execute name matching.
  5. 30-Day Purge: Raw encrypted OCR is automatically purged after 30 days (retention.encryptedOcrPurgeAfter), permanently destroying the raw PII while preserving the masked record for audit history.

Webhook Hold Safety Floor​

When records are configured in ephemeral or none mode, Verifik enforces a minimum 24-hour webhook hold window (configurable up to 72 hours).

This guarantees:

  • If a client's webhook endpoint is temporarily unreachable, retry chains (which can run up to ~23 hours) will still have access to the data until delivery succeeds.
  • Once the terminal webhook is acknowledged, the purge countdown is triggered.

Policy Inheritance Hierarchy​

Policies resolve hierarchically with strict safety clamping:

System Defaults ➔ Client Account ➔ Project Override ➔ Project Flow Override

[!IMPORTANT] Compliance Floor: A less restrictive policy cannot override a more restrictive parent policy. For example, if an account enforces none mode, a child project flow cannot loosen the mode back to store.

Right to Erasure & Manual Deletion​

Organizations can trigger immediate erasure via API:

  • Erase Images Only: DELETE /v2/document-validations/:id/files removes Spaces objects while keeping the verification score and status for billing.
  • Erase Enrollee Data (GDPR): DELETE /v2/app-registrations/:id/data permanently wipes all images, selfies, and PII fields for an enrollee.
  • Bulk Erase: POST /v2/data-retention/erase triggers an asynchronous project-wide purge before a given date.