Retention and deletion
ID images are purged automatically. The record of the check isn't.
Verifying someone means holding their government ID for a moment, not forever. ShieldID keeps the image only as long as it takes to read it, then deletes it on a timer it doesn't wait to be told about.
The default
Seven days, then gone.
Every ID image and selfie ShieldID captures is deleted automatically, seven days after it was uploaded, by default.
- The countdown starts the moment the image is captured, not when someone remembers to clean up.
- Deletion is a real removal of the stored file, not a soft flag that leaves the bytes sitting in storage.
- The default applies across every account today. Per-account retention windows are coming soon.
Two sweeps, not one
An hourly check, and one right after every restart.
A timer is only as good as the process that enforces it, so the purge runs twice as often as it strictly needs to.
Hourly
A sweep runs on a fixed interval, checking every stored image against its retention window and deleting anything past due.
After every restart
The same sweep also runs shortly after the service starts. A service that spends a quiet stretch fully idle would otherwise keep documents past the day we said they'd be gone — so the check runs again the moment it comes back up, instead of waiting for the next scheduled hour.
What outlives the images
The record stays. The photos don't.
Retention isn't one clock. The image and the fact that a verification happened are kept on entirely different terms.
- ID images and the selfie
- Purged automatically, seven days by default.
- The verification record (result, per-field verdicts, timestamps)
- Persists. It has no automatic purge job — it's what lets you answer a question about a check months after the photo is gone.
- Activity Ledger entries
- Persist indefinitely. There is no delete or purge path for the governance record itself; it is append-only by design, described on the Activity Ledger page.
What's coming
Two things we haven't shipped yet, named so you can hold us to them.
Per-account retention settings
Coming soonChoosing your own window instead of the shared seven-day default. Today, every account uses the same setting.
Purge receipts in the ledger
Coming soonAn entry written at the moment an image is purged, so "was it actually deleted, and when" has an answer in the record itself, not just in this page's description of the timer.
Deletion on request
Need something removed sooner than the timer?
The seven-day default already removes ID images automatically without anyone asking. If you need a verification's images deleted sooner, or have a question about what a specific account is holding, contact us directly and we'll handle it by hand while the self-serve setting is being built.
Questions
Straight answers about retention and deletion.
See where it's held
Retention only matters alongside where the data sits.
Read how residency and encryption work together with this timer.