Compliance
This section describes mechanisms: what the system does with identity data, on what schedule, and with which safeguards. Every statement here is meant to be checkable against running code or configuration.
What this section is not
Veridia is not certified, audited, or approved against any standard. There is no SOC 2 report, no ISO certification, no external security audit, and no regulator has reviewed or approved this system.
These pages do not say that Veridia "complies with" GDPR, SEPRELAD, LGPD, or anything else. Compliance is a property of your regulated activity, not of a vendor's product page. What we can tell you is exactly what the software does, so that you and your counsel can decide whether it fits your obligations.
If you are looking for a document to hand to an auditor as evidence of certification, it does not exist. If you are looking for a precise description of how identity data is handled so you can complete your own assessment, that is what this section is for.
The pages
| Page | What it covers |
|---|---|
| Data retention | How long images are kept, per jurisdiction; what is deleted and what survives forever; the daily sweep that does it |
| SEPRELAD and AML | What sanctions screening actually does, and why Veridia produces no regulatory filing |
| GDPR | What personal data flows where, and which data-subject rights have no implemented mechanism today |
| Security | Webhook signing, the SSRF guard, key types and storage, tenant isolation, rate limits, and the controls that do not exist |
The short version
Four things are worth knowing before you read any further.
Only images are deleted. The retention sweep removes the document and selfie files from storage. The database row — verdict, extracted identity fields, audit trail — survives indefinitely, by design, because that row is the record of the identity check. See Data retention.
Your webhook endpoint receives identity PII. The payload includes fieldsExtracted with full name, document number, and date of birth. That makes your endpoint, and anything that logs its request bodies, a store of personal data. Plan for it.
A sanctions hit never auto-rejects. A strong match against the screening lists forces the verification to review so a person decides. The system will not reject someone on a name match alone.
Several things you might assume exist do not. There is no data-processing agreement on offer, no consent capture in the widget, no self-service erasure or export, no application-level encryption of the identity columns, and no SEPRELAD report generation. Each is stated plainly on the relevant page rather than left for you to discover.
Where legal judgement is required
The following need advice from counsel who knows your regulated activity — this documentation cannot substitute for it:
- Which retention period actually binds you. The periods implemented here were set by the business; your obligation may differ by activity, not just by country.
- Whether you are a controller and Veridia a processor, and what agreement that requires.
- What lawful basis you rely on for processing biometric data, and how you obtain it. The widget does not capture consent.
- Whether the screening lists covered here are sufficient for your obligations. They are sanctions lists only — no PEP list, no adverse media.
Reporting a security issue
If you find a vulnerability, please report it privately rather than opening a public issue. See Support for contact details.