Your identity matters.
So does your privacy.
Identity verification requires disclosing personal information. You should be able to see and understand how that information is handled.
When you verify with Persona, your data is used for defined purposes, protected by security practices, and kept within defined limits.
Manage your dataHow we verify identity
Why does identity verification (IDV) exist?
Many online services verify identity to:
- Prevent fraud and impersonation
- Comply with financial, safety, or age-related regulations
- Protect users and platform integrity
What is Persona's role when an organization asks me to verify my identity?
Persona primarily acts as a data processor. This means we process information on behalf of the organization you're interacting with, and only to provide identity verification and related services they've requested.
In limited circumstances such as Persona Wallet, Persona may act as a data controller. This means we decide how your information is handled, in accordance with applicable data protection laws.
What personal information might Persona collect?
We collect only what's needed to provide the service requested. This may include:
- Information you provide (e.g., name, contact details, government ID images)
- Photos or video you upload (e.g., for facial recognition)
- Device or technical data (like IP address or browser signals)
- Data from third-party sources if used in verification
How does Persona use my data?
We use your information only to complete the verification or fraud prevention checks requested by you directly or the organization you're interacting with. We do not use your personal information collected for these purposes for marketing, and we don't sell to third parties.
How verification works
Collection
You submit information during a secure verification flow. Depending on what the organization requires to meet compliance or trust and safety initiatives, this may include a government ID, selfie, business details, or something else.
How verification works
Processing
Persona uses automated systems and predefined rules to verify your information. Depending on the organization's requirements, this may include checking it against fraud signals and trusted data sources, such as public records. Each organization determines what information they require to verify your identity. They may provide the information directly, or Persona may collect it on their behalf.
How verification works
Outcome
We return an outcome to the company that asked you to complete verification, which may include a status (for example, “verified” or “not verified”) and relevant signals or supporting information based on their configuration and use case. The company can access the information you submit, along with your verification status and related information. However, in some flows, such as Relay, access to information is limited.
Persona, when acting as a processor, does not determine how an organization uses your data. Persona only uses the data to perform the services requested by the organization. The organization retains and redacts your information in accordance with its privacy policies.
Privacy by default
We do not sell or share personal data processed for verification purposes, and we do not use personal data outside the scope of what is listed in our privacy policy.
Does Persona sell or share my data?
No. Persona does not sell or share personal data (as those terms are defined under privacy laws) processed for verification purposes or broker it to third parties.
Is my data used to train AI models?
No. We do not repurpose your personal data, broker it, or use it for any AI or model training.
Who has access to my data?
Access by Persona is limited to automated systems and authorized personnel under strict role-based controls. Human review only occurs when configured by the organization you are interacting with and is subject to audit and oversight.
How does Persona work with companies?
We work with organizations across industries that need secure identity verification and assurance.
How much data do I have to provide?
In most cases, the organization you are interacting with determines the data we collect. We collect the minimum data needed and evaluate the impact of our activities on data privacy to improve our practices.
How does Persona safeguard my data?
We use industry-standard safeguards including encryption, secure storage, and access controls to protect your information while we process it. These measures reflect our security-first design and compliance frameworks.
Privacy Notices
How we safeguard your data
Beyond limiting how data is used, we apply layered safeguards to protect it while it is processed and stored.
Minimal human exposure
Persona's systems are primarily automated and require minimal human oversight. If an organization requires human review, they configure it themselves, and it's always logged and audited.
Secure hosting environment
Verification services run on secure cloud infrastructure designed with physical, network, and operational safeguards. Access to verification data is scoped to the organization that requested it and governed by role-based controls.
Encryption in transit and at rest
Your information is encrypted while being transmitted and while stored, helping prevent unauthorized access.
Restricted system access
We limit access to sensitive data through single sign-on, logged access, and role-based permissions, which we regularly review.
Monitored infrastructure
We continuously monitor our systems for unusual activity and use alerts and response processes to act quickly.
Ongoing security review
We conduct regular internal reviews and external assessments to evaluate and improve our security controls over time.
Passkeys for Persona Wallet
Information saved to a Persona Wallet is encrypted and protected by passkeys — a passwordless authentication method secured on your device by protections like Face ID — which ensures only you can unlock and share it.
Data residency options
Your data is stored in either a US or EU data center, based on where the organization you verified with has chosen to process data, so it remains subject to local privacy laws.
Building with Persona?
Security and privacy are paramount to a trusted relationship. That's why Persona aligns its security and privacy practices with recognized industry standards and helps you manage your customer data by giving you control: field-level redaction, granular retention controls, a choice of US or EU data residency, and more, so your privacy practices can reflect your users' needs and your compliance requirements.
Your data rights and control
How we process your data depends on whether we're acting as a processor or controller, the organization's configuration, and applicable laws.
What rights do I have over my information?
You may have the right to:
- Access your personal information
- Correct inaccurate information
- Request deletion of your information
- Receive a copy of your information
Check the privacy policy of the organization you're interacting with to confirm your rights. For services where Persona acts as a controller of your data, review our privacy policy here.
Where can I find and manage my data?
Visit our Privacy Portal below to submit your request, review summaries of potential matches, and take action.
How long is my data retained?
Retention periods vary by organization and applicable legal requirements. In some cases, it must be kept for a set period to meet fraud prevention or regulatory obligations.
How do I delete my data?
Submit a request through the Privacy Portal below. We'll review your request, route your request to the appropriate organization, or address your request directly depending on how your data was processed.
Who can I contact with privacy questions?
For questions about Persona's privacy practices, visit our Privacy Portal below to submit your request. You can find more details in the privacy notices listed on our website above.