Trust & security
Identity verification that gives you controls and evidence, not a certificate we can't back up.
Not a badge, not a certificate we don't hold — a plain account of where your applicants' data lives, what we keep, for how long, who can see it, and how you can check our answer against the record.
Where your data lives
Hosted on our own servers, on infrastructure we control.
ID images, extracted fields and verification results are processed and stored on infrastructure Crown Stack Systems controls, in Canada. Your applicants' data crosses the border to get there; we say so plainly rather than implying US hosting.
A single reverse proxy terminates every connection at the edge with TLS, HSTS and a locked-down set of security headers. It is the only thing published to the internet.
The database, the cache, the secrets store and the object store that holds ID images sit behind that proxy on a private network. None of them is directly reachable from the internet.
We don't offer a choice of region today. One estate, one location, stated plainly rather than implied with a flag icon.
Read the full data residency page →What is stored, and for how long
We extract what the decision needs, then start the clock.
A verification produces a result and, separately, a pair of images. The two are treated differently, on purpose.
- ID images and the selfie
- Encrypted at rest with AES-256-GCM. Purged automatically on a short timer, seven days by default, checked hourly and again after every restart.
- Date of birth
- Stored encrypted, not in plain text, wherever it is held.
- The verification record
- Outlives the images: it says a check happened and how it ended, long after the photos are gone.
- Per-account retention windows
- Coming soon. Today the seven-day default applies to every account.
Who can see it
As few people as possible, and every one of them accountable.
Access control is a mix of what the software enforces and what it takes to reach the data at all.
Two-factor sign-in — Coming soon
The portal can enforce a TOTP code once it's set on an account, but self-serve enrollment isn't available yet.
The network does the rest
Storage and databases have no public address. Reaching them means going through the application, and the application is on the record.
Evidence access is itself logged
The network and device detail behind a ledger entry needs a written reason before anyone, including us, can read it.
How to prove it
Don't take our word for it. Read the ledger.
Every sign-in, document view, verification outcome and export is entered in an append-only Activity Ledger, enforced by the database itself: entries can be added, never edited or deleted. It is how you answer "who saw this?" without asking us.
Read the detail
Six pages, one for each control.
Every claim on this hub links to the page that backs it up.
Data residency
Hosted on our own servers in Canada, on infrastructure we control. Your data crosses the border to get there. Never a public cloud, never hosted in the US.
Data residency →Encryption
TLS in transit, ID images and dates of birth encrypted at rest, secrets in a dedicated vault.
Encryption →Retention & deletion
ID images purged automatically, seven days by default. The record stays. The photos don't.
Retention & deletion →Compliance
State privacy and biometric law, and what we give you to support it. No certification we haven't earned.
Compliance →Activity Ledger
An append-only record of who did what, enforced by the database, not by policy alone.
Activity Ledger →Responsible disclosure
Found a vulnerability? Here is exactly how to tell us, and what you can expect back.
Responsible disclosure →What we do not claim
Candour is a control too.
The identity-verification industry prints badge rows. We would rather tell you what is true today, and what is on the way.
- No SOC 2, ISO 27001 or similar certification. We do not hold one yet, and we will not print a badge we haven't earned. When we do, it will carry an issue date and a stated scope.
- No named data center and no city named. We say "our own servers, on infrastructure we control," not a provider, facility name or location, because that is the honest level of detail we can stand behind today.
- No geo-redundant backups. Backups are encrypted and follow a documented restore procedure, but they do not currently leave the building.
- No claim that this page is legal advice. It describes what the platform does. Whether that satisfies your organization's obligations under a state privacy law, a biometric privacy law such as Illinois' BIPA, a sector rule like a lender's Customer Identification Program, or any other regime is a question for your own counsel.
Questions
Straight answers about trust and security.
Questions we haven't answered here
Talk to us before you build on ShieldID.
Security questionnaire, a specific control you need evidence for, or a question this page didn't answer — ask us directly.