Security and compliance

How data is protected, kept and deleted.

#Data protection

• Uploaded files are encrypted at rest with AES-256-GCM.
• API keys and session tokens are stored hashed. Passwords use scrypt.
• Console sessions use HttpOnly cookies. Every console and API action is written to an audit log.
• Face matching, liveness and OCR run on our own servers. Images are not sent to outside AI services.
• Sandbox and live data are stored separately.

#Hosting

ScreenKaptain is built and hosted in the UK.

#Retention and deletion

• A daily job deletes data older than your retention period. Biometric data can have a shorter period.
• Erase one user at any time: DELETE /v3/session/{id}/delete/ or DELETE /v1/verifications/{id}/data.

#Your role under GDPR

You are the data controller for your users. ScreenKaptain processes their data on your behalf. Biometric data is special-category data under UK and EU GDPR, so record a lawful basis and explicit consent, which the hosted flow collects on its first screen.

#Compliance programme

We keep a SOC 2 and ISO 27001 control set, policies and evidence export. Ask us for the security pack.