Compliance
There's no single US privacy law like PIPEDA. Here's the landscape, and what we give you.
"Compliant" gets printed on a lot of trust pages with nothing behind it. Here is specifically what ShieldID does that supports your organization's own privacy obligations under US law, and what it doesn't do.
The US privacy landscape
State comprehensive laws, state biometric laws, and whatever sector rule you already carry.
There's no single federal privacy law in the US covering identity verification. Instead there's a patchwork, and ShieldID is built around the parts of it that touch what we do.
- State comprehensive privacy laws, California's CCPA/CPRA and a growing list of others, give consumers rights like access, deletion, correction and the right to opt out of a sale of their personal information.
- State biometric privacy laws apply directly to face matching and liveness. Illinois' BIPA, Texas' CUBI and Washington's biometric privacy law each set their own rules for collecting and handling biometric identifiers.
- Many of our customers carry a sector rule on top of state law, a lender running a Customer Identification Program, for example. ShieldID's per-field verdicts and evidence are built to be an input to that process, not a replacement for it.
- Compliance with any of these is an obligation of the organization using ShieldID, not something we can certify on your behalf. What we provide is the controls and the record; how they fit your organization's obligations is a question for your own counsel.
Where we come from
Crown Stack Systems is Canadian, and PIPEDA still applies to us.
ShieldID is built by Crown Stack Systems, based in Oshawa, Ontario. As a Canadian company, we're accountable under Canada's federal privacy law, PIPEDA, for the personal information we handle, regardless of where our customers are. That's a fact about us, not a claim about your own compliance obligations as a US business; those are set by the state and sector rules described above, and are yours to meet.
Consent
Captured in the flow, not assumed.
An applicant sees what's being collected and why before their document and face are captured.
- Consent is presented to the applicant, on their own device, as part of the verification flow itself, before their ID and face are captured, not buried in a separate terms page they never open.
- Acceptance is recorded as an EULA_ACCEPTED event in Trust Ledger's Activity Ledger at the moment it happens. A separate, biometric-scan-specific consent event does not exist yet.
- The images described by that consent are the ones purged automatically after seven days by default, described on the retention page.
Operational controls
What ShieldID actually provides, not a policy binder.
Consent capture
The applicant accepts what's being collected, on their own device, before their ID and face are captured. Acceptance is recorded as an EULA_ACCEPTED event.
Automatic image purge
ID images and the selfie are deleted automatically after seven days by default, checked hourly and again after every restart.
No sale of personal information
We don't sell applicants' personal information, to anyone, for any reason.
Not used to train models
Verification images and results are used to deliver your verification, never to train a model.
Per-field verdicts and evidence
Each check, document, face match, liveness, is reported as its own verdict with the evidence behind it, not one bundled score.
Append-only Activity Ledger
Live today for Trust Ledger accounts; coming soon for a standalone ShieldID API account.
Two-factor authentication
Coming soon for self-serve enrollment. Once a TOTP code is set on an account, the portal enforces it at sign-in.
Prove it, don't just claim it
The Activity Ledger is how compliance stays checkable.
A policy that says access is controlled is a promise. A ledger that shows every access, enforced by the database, is evidence. That's the difference we're building toward, and it's already live for sign-ins, document access and verification outcomes.
Certifications
None held yet. We won't print a badge we haven't earned.
No SOC 2, ISO 27001 or similar certification exists for ShieldID today, and none is implied anywhere on this site. There's also no such thing as being "CCPA compliant" or "BIPA compliant"; these are laws that create obligations for the business collecting data, not certification programs a vendor can pass, and we won't imply otherwise. If we hold a certification in the future, it will appear here with the date it was issued and exactly what it covers.
One more thing
This page is not legal advice.
It describes what the ShieldID platform does. Whether that satisfies your organization's specific obligations under a state privacy law, a biometric privacy law such as Illinois' BIPA, a sector rule like a lender's Customer Identification Program, or any other regime is a question for your own counsel or privacy officer, not for a marketing page.
Questions
Straight answers about compliance.
Talk to us
Have a specific compliance question?
Ask us directly — for a security questionnaire, a specific control, or something this page didn't cover.