Security

1. Our approach

Identity Entry is built on the idea that the safest information is information that is protected while it exists and deleted as soon as it is no longer needed. This page describes the measures in place today. It does not claim any certification.

2. Encryption of photos

ID photos and selfies are encrypted before they are stored. They can be retrieved only through a signed-in request from the workspace that requested the check. Connections to the website, console, API and capture pages are encrypted in transit.

3. Capture links

Each capture link is signed, carries a short-lived token, is meant for one check and closes after 30 minutes. After it closes, no more images can be captured through it.

4. Workspace isolation

Each business works in its own workspace. Checks, photos, results and settings in one workspace are never returned to another. Every request is checked against the workspace it belongs to.

5. Accounts and sign-in

• Passwords are stored only as salted hashes, never in readable form.
• Signing in sets one HttpOnly session cookie that page scripts cannot read.
• API keys belong to a workspace and can be revoked by the business at any time.

6. Signed webhooks

Webhooks that report check results are signed with HMAC-SHA256, so your systems can confirm that each message came from Identity Entry and was not changed on the way. Verify the signature before acting on a webhook.

7. Audit log

Every decision recorded on a check is kept in the workspace audit log with who made it, when and why. This lets a business explain and review its decisions later.

8. Safe results

A check that cannot be completed is never a Pass. Results are always Pass, Caution or Fail, and a background search match is always Caution so that a person reviews it.

9. Keeping photos

ID photos, selfies and movement-check frames are encrypted before they are stored and stay with the account of the business that requested the check. The business has 7 days to review the results. See the Data Retention policy.

10. Records check

Identity Entry does not collect Social Security numbers, so none can be exposed through its systems.

11. Your part

Security is shared. Keep passwords private, keep API keys on your own servers, verify webhook signatures, send capture links only to the people they are for, and remove team members who no longer need access.

12. Reporting a vulnerability

If you believe you have found a security problem, tell us through the contact page. Include enough detail for us to reproduce it. Please do not access other people's information, disrupt the service or share the problem publicly before we have had a chance to fix it. We will acknowledge good faith reports and keep you informed.