Data residency
Canadian data residency for identity verification.
Every ID image, extracted field and verification result ShieldID handles is processed and stored on our own servers, on infrastructure we control. Nothing crosses the border to be processed, and we do not offer a choice of region — because there is only one.
One estate, one location
The whole pipeline runs on infrastructure we operate.
There is no cloud region picker behind the scenes and no subcontractor processing your applicants' documents elsewhere. Capture, read, match, decide and record all happen on the same estate.
RentKey, Trust Ledger and Crown Ledger, the products ShieldID's identity checks power today, draw on the same infrastructure — not a separate regional deployment per product.
"Our own servers" means infrastructure Crown Stack Systems operates directly, not a named public cloud provider or a specific facility we can point you to. That is the accurate level of detail, and we'd rather state it plainly than dress it up.
A verification session, an uploaded ID photo and a face-match result never leave that estate to be processed by a third party.
The edge is the only door
One proxy in, nothing reachable behind it.
A single reverse proxy is the only thing published to the internet. Everything that actually holds your data sits behind it, with no public address of its own.
- Edge
- Terminates TLS for every request, with HSTS and a locked-down set of security headers, before anything reaches the application.
- Application
- The only layer that talks to the database, the cache, the secrets store and the object store.
- Database
- Holds verification records and session state. Not directly reachable from the internet.
- Cache
- Session and rate-limit state. Not directly reachable from the internet.
- Secrets store
- API keys, database credentials and encryption keys, in a dedicated vault. Not directly reachable from the internet.
- Object store
- Where uploaded ID images live until they're purged. Not directly reachable from the internet.
A worked example
What happens when an applicant uploads an ID, start to finish.
The applicant's phone talks to the edge. Everything after that stays inside the same estate.
Capture
The applicant's browser uploads the front and back of the document, then a selfie, over TLS to our edge.Extract and match
The barcode, the MRZ and the printed face are read, cross-checked and compared to the live selfie by services running on the same estate — no call out to a third-party OCR or biometric vendor.Decide and record
Verdicts are written to the database and the result is delivered by webhook, still without the data leaving our estate.Purge
The images are deleted automatically on the retention timer. The record of the verification stays; the photos don't.
No region picker, and we say so
We don't offer a choice of region today.
A multi-region option is not offered today. If that changes, this page changes with it — we won't leave an old claim standing after the facts move.
Built for Canada, not adapted for it
English and French, for the people using it.
The verification flow your applicants use, and the portal your team signs into, are available in English and French — not a machine-translated afterthought bolted onto an English-only product.
A fair question
"Isn't self-hosted less resilient than a big cloud region?"
It can be, and we're not going to claim otherwise. We run encrypted backups with a documented, rehearsable restore procedure, but those backups stay on the same premises today — we do not offer geo-redundant backups or a disaster-recovery site. If that matters for your use case, ask us directly; we'd rather answer the question than bury it under a badge.
Questions
Straight answers about where the data lives.
See it for yourself
Run a sandbox verification and watch where it goes.
Create a sandbox session, complete it on your own phone, and read the result. Sandbox sessions are never billed.