Data handling¶
VeriSaaS Cloud is designed to keep as little customer data as possible, for as short a time as possible. Storing validation data in the cloud is optional and is decided by the customer.
What VeriSaaS Cloud stores¶
| Data | Stored? | For how long |
|---|---|---|
| Biometric queries (face, voice) | No. Engines such as das-Face and das-Peak are stateless | Only while the request is processed |
| Validation data (Validas) | Temporarily, until the customer downloads and deletes it | Until deleted by the customer, or until the auto-cleaner expiration time |
| Stored validations (optional) | Only if the customer chooses to store validations in VeriSaaS Cloud | Retention period agreed with the customer |
| Operational logs | Technical metadata needed to operate and secure the service, such as timestamps, source IP addresses and response codes | Limited retention period |
Optional storage¶
By default, the customer's middleware or back office downloads the results of each validation and then deletes it from VeriSaaS Cloud. If a validation is not deleted, the Validations Auto-Cleaner removes it when its expiration time is reached.
Customers who prefer not to keep validations on their own premises can choose to store them in VeriSaaS Cloud, for example to review them later. In that case:
- The data stays in the region where the service is provisioned (AWS EU, AWS US or GCP EU).
- The data and its backups are encrypted at rest.
- The retention period is agreed with the customer, and the data is deleted when that period ends.
Backups¶
Backups are automated, encrypted and replicated to a secondary location within the same geographic area, so that the service can be restored if a whole region becomes unavailable. See Resilience & Disaster Recovery.