link What we keep
| Data | Why |
|---|---|
| Your reference for the customer | To link their attempts. No name, email or address is stored. |
| ID photos, selfie video and still frames | To run the checks, and for your team to review. |
| Details read from the document | To check them, and for your team to review. |
| Their consent | When they agreed, the wording version they saw, and the device's IP address and browser. |
| Results and signals | To explain every decision. No images. |
| Fraud memory | One-way fingerprints and a numerical description of the face, to catch the same identity used again. |
link Encryption
| Data | At rest |
|---|---|
| Photos and video | AES-256-GCM with a new key per file, before upload. The bucket holds ciphertext only. |
| Details read | AES-256-GCM with a key per session. |
| Fraud memory: faces | AES-256-GCM with a key per entry. |
| Fraud memory: fingerprints | HMAC-SHA256 with a server-held key. Can't be turned back into the original. |
| Webhook signing secrets | AES-256-GCM. Shown to you once, when created. |
Each per-file and per-session key is wrapped by a master key. The master key is stored only in wrapped form; a key service unwraps it into memory when the app starts. The key service holds the root key, never releases it, answers only KayWhySee's own servers, and logs every request.
Stored in the EU (Germany). All traffic to KayWhySee is HTTPS.
link AI review
When the only findings are parts of a document the checks couldn't read, the document images are sent to Anthropic (Claude, United States) to read again, with the holder's photo blanked out. Anthropic processes them for KayWhySee and doesn't train on them; nothing else is sent. On by default; turn it off for a workspace under Settings → AI review.
link Access
- Photos and video have no public URL. They're shown only in your dashboard, and each view is written to your audit log.
- Each account sees only its own sessions.
- Reviewing a session needs the View evidence permission.
link Retention
| Data | Deleted |
|---|---|
| Photos and video | After your retention period, counted from the decision: 30 days by default, 1 to 90 under Settings for each workspace. A change applies to files already held. |
| Details read | 90 days after the decision. |
| Consent IP address and browser | With the photos and video. |
| Results and signals | After 2 years. |
| Fraud memory | After 2 years. |
link Deletion and backups
| Data | What happens |
|---|---|
| Photos and video | Gone when deleted. The bucket keeps no versions, and there are no copies or backups of it. |
| Database backups | Continuous, with 7 days of point-in-time restore. A deleted record stays in them for up to 8 days. They hold no photos or video. |
| Backup encryption | A key unique to the database, which the storage provider never holds. Details read and fraud-memory faces are also encrypted inside them, as above. |
| Daily check | The bucket is compared with the database every day. A file with no matching record is deleted. |
link Your customers' rights
You're the controller of your customers' data; KayWhySee processes it for you. To delete a customer's data, send us their reference.
The privacy notice your customers see before they agree: /privacy.