Your identity matters.
So does your privacy.
Identity verification requires sharing personal information. We believe you should understand how that information is handled.
When you verify with Persona, your data is processed with security best practices, for a specific purpose, and within defined limits.
How we verify identity
Why does identity verification (IDV) exist?
Many online services verify identity to:
- Prevent fraud and impersonation
- Comply with financial, safety, or age-related regulations
- Protect users and platform integrity
In many cases, verification is required by law. In others, it helps reduce scams and misuse.
Verification serves a defined purpose. Our role is limited to helping the organization you are interacting with fulfill that purpose securely.
How does Persona handle my information?
Persona primarily acts as a data processor. This means we process information on behalf of the organization you're interacting with, and only to provide identity verification and related services they've requested.
In limited circumstances such as Persona Wallet, Persona may act as a data controller. In those cases, we determine the appropriate handling of information consistent with applicable data protection laws.
How verification works
Collection
You submit information during a secure verification flow, such as a government ID, selfie, or business details, based on what an organization requires to meet compliance or trust and safety initiatives.
Assurance-based verification with Checkpoint
In many cases, organizations do not need your full identity information. They only need a light-weight assurance, such as whether you meet an age threshold.
Persona supports assurance-based verification via Checkpoint. Instead of sharing full identity details, you can verify a specific attribute. The organization receives confirmation of that attribute rather than your complete identity information. This approach reduces the amount of personal data that must be collected, stored or disclosed.
How verification works
Processing
Persona evaluates the authenticity of that information using secure, automated systems and predefined rules, such as comparisons to select fraud checks and data sources, including public records, set by the organization for that verification flow.
How verification works
Outcome
We return a outcome to the organization requesting verification. This may include a status (for example, "verified" or "not verified") along with relevant signals, insights, or supporting data needed to inform their decision, depending on their configuration and use case.
We do not share or repurpose your data beyond that service or decide how it is used. The organization may retain or redact your information under its own policies.
Privacy by default
Privacy and data security are core to how we operate. We do not sell or share personal data processed for verification purposes and we do not use personal data outside the scope of what is listed in our privacy policy.
Does Persona sell or share my data?
No. Persona does not sell personal data or broker it to third parties. Privacy and data security are core to how we operate.
Is my data used to train AI models?
No. We do not use any personal data for any AI or model training.
Who has access to my data?
Access is limited to automated systems and authorized personnel under strict role-based controls. Human review only occurs when configured by the organization you are interacting with and is subject to audit and oversight.
How does Persona work with companies?
We work with organizations across industries that need secure identity verification. We do not disclose details of customer relationships, and we do not share user data beyond providing our services.
How we safeguard your data
Beyond limiting how data is used, we apply layered safeguards to protect it while it is processed and stored.
Encryption in transit and at rest
Your information is encrypted while being transmitted and while stored, helping prevent unauthorized access.
Restricted system access
Access to sensitive data is limited through role-based permissions, single sign-on, and logged access. Permissions are regularly reviewed.
Monitored infrastructure
Our systems are monitored for unusual activity, with alerts and response processes in place.
Secure hosting environment
Verification services run on secure cloud infrastructure designed with physical, network, and operational safeguards.
Ongoing security review
We conduct regular internal reviews and external assessments to evaluate and improve our security controls over time.
Passkeys for Persona Wallet
Information saved to a Persona Wallet is encrypted and protected by passkeys—a password-less authentication method secured on your device by protections like Touch ID or Face ID—ensuring only you can unlock and share it.
Your data rights and control
How your data is processed depends on Persona's role as a processor or controller, an organization's configuration and applicable laws.
How do I delete my data?
You can request deletion by contacting the organization you completed verification with. In some cases, your data may also be automatically deleted after processing, depending on their settings and applicable laws.
If Persona is acting as the data controller, you can delete your information directly within your Persona Wallet.
How long is my data retained?
Your data is retained based on the organization's policies and legal requirements. In some cases, it must be kept for a set period to meet fraud prevention or regulatory obligations.