How Persona handles data and privacy

When you evaluate an identity verification (IDV) provider, you need clear answers about how it collects, retains, and protects data. With Persona, those answers depend on three factors: what your company has configured the platform to collect, the certifications and regulations that apply to data storage and processing, and the engineering practices that protect data in transit and at rest.

This piece walks through each of those layers in plain language so you can evaluate Persona against your privacy and compliance requirements.

How does Persona handle the data collected from users?

When you use Persona to verify users, your company decides what information to collect, who can access it, and how long Persona retains it (within applicable limits). Persona handles that information on your behalf, following your instructions. In privacy-law terms, your company is generally the data controller, and Persona is the data processor. The GDPR calls this a controller-processor relationship, while the CCPA uses the corresponding terms business and service provider.

Persona does not sell user data or use verified data to train AI models. It processes the personal data your users submit to complete the verification you configure.

Some checks require Persona to send data to an authoritative source. For example, a configured check might compare fields extracted from a US driver’s license with the issuing state’s DMV database. In these cases, Persona handles that transfer on your behalf, sending only the fields necessary for the check.

How long does Persona retain user data?

You configure how long Persona retains the data collected through your verification flows and when Persona redacts it. However, some data types have product or legal limits. Face templates, for example, can’t be retained for more than three years.

When data is deleted from Persona’s system, it is permanent and cannot be restored.

Logs follow separate retention rules. Your team can configure retention for some of your audit and event records, while Dashboard logs and webhook events have their own availability periods.

Device signals are global to the platform and can persist beyond your configured retention window. If you are modeling data life cycles for a long-term deployment, include these signals in your assessment.

What checks does Persona actually run during a verification?

The checks Persona runs depend on how you configure each verification flow. Persona offers a library of methods, including government ID assessments, selfie verifications, database lookups against authoritative sources, selfie-based age estimations, and email and phone inferences. You select the checks that fit your use case when you configure the flow.

Take age assurance as one example. You can use a selfie-based age estimate when it satisfies the relevant requirement, an email or phone inference when it meets the regulatory threshold, or a government ID assessment when the jurisdiction or risk profile requires it. You can also combine checks when your use case calls for more than one signal.

Persona does not run every available check on every user. It runs the checks you select using the signals your use case requires.

For a detailed look at how this applies to age assurance, see our piece on age verification and privacy and Atlas, Persona’s global age regulation tracker.

How does Persona handle biometric data specifically?

Persona encrypts raw selfie images and video at rest and stores them in durable object storage. When you enable face-matching across verifications, Persona can keep a face template for comparison in a separate data store.

Retention settings differ for captured selfie images/video and for the templates used for matching. You can configure redaction and set how many versions Persona keeps and for how long, subject to a three-year maximum for biometric templates. For example, you may want to configure a two-year retention period for Colorado. Review the settings for each data type when you define your retention policy.

How do Persona Wallet and Relay enable data minimization?

Not every verification requires you to collect a user’s full identity. Persona Wallet reduces friction across the user life cycle by accepting previously verified credentials, so returning users do not have to repeat the process from scratch.

Relay supports data minimization by letting you verify a single claim, such as whether a user meets an age threshold or is a real person, without requiring your system to collect the user’s full identity. Your system receives a pass/fail result, not the user’s underlying personal data, and Persona doesn’t see what the user is trying to access. Built on the IETF Privacy Pass standard and blind signatures, Relay ensures that no single party, including Persona, can reconstruct the link between a person’s personal information and the site requesting verification.

What certifications and third-party validations cover Persona?

Persona’s security and privacy practices are supported by independent assessments, certifications, and contractual commitments, including:

• SOC 2 Type II: An independent examination of Persona’s controls relevant to security, availability, confidentiality, and privacy over an audit period.

• ISO 27001: An international standard for information security management systems, covering the policies, processes, and personnel across Persona’s operations.

• Kantara IAL2: Kantara has approved Persona’s identity-proofing component at IAL2 under NIST SP 800-63-3 for use in the United States.

• HIPAA compliance: Requirements that govern the secure handling of protected health information, where applicable.

• GDPR and CCPA: Persona’s data processing addendum (DPA) sets out the contractual terms of its processor relationship under applicable privacy law.

Separately, Persona for Government, Persona’s government offering, is FedRAMP® Certified Class C (Moderate) and listed on the FedRAMP Marketplace.

These credentials and commitments cover different aspects of Persona’s practices. Review each report, certification, or agreement for its scope.

Persona hosts its platform on Google Cloud Platform and uses AES-256 encryption and TLS 1.2+. You can find the full list of certifications on Persona’s security page. For a closer look, read Trail of Bits’ independent code review of Persona’s data practices.

In addition to third-party security certifications, Persona is recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Identity Verification, the KuppingerCole Analysts Leadership Compass: Identity Verification 2026, the 2026 Liminal Index™ for Business and Entity Verification, and the Forrester Wave for Identity Verification Solutions, Q3 2025.

How does Persona use AI, and is customer data used to train AI models?

Persona does not use verified user data to train AI models. It processes the personal data your company collects via verification flows to run the checks your team configures.

Persona uses AI and machine learning across several parts of the verification pipeline, including document classification and data extraction, selfie liveness detection, deepfake and injection attack detection, device risk signals, and selfie-based age estimation. Model-development practices and contractual data-use terms vary by product and deployment.

Using data to run a verification is different from using it to train or tune a model, and Persona treats these as distinct uses of data. If you work in financial services, healthcare, or government, this distinction is an important due diligence consideration as you assess AI training on sensitive data.

The questions below address the main data-handling questions you may have as you evaluate Persona. For questions specific to age assurance, see How Persona supports age verification and privacy online. If you’re a user who went through a Persona flow, our privacy page explains your rights and how to exercise them.