Built to hold as little of your data as possible.

We screen your customers without keeping a readable copy of them. Here is what we store, where, and for how long.

Data	Where	How long
Organization name, member emails, password hash, API key hashes, Stripe customer ID	Cloudflare D1, restricted to the European Union	While the account is open
Subject map: our numeric reference and a keyed HMAC of the identifier. No name or ID number	Cloudflare D1, restricted to the European Union	While the account is open
Call log: time, key prefix, route, status, request ID. No names or identifiers	Cloudflare D1, restricted to the European Union	30 days
Webhook delivery log: time, event ID, HTTP status	Cloudflare D1, restricted to the European Union	30 days
Developer invite: email and the invite link	Cloudflare D1, restricted to the European Union	7 days, or until used
Idempotency replay of a response	Cloudflare D1, restricted to the European Union	48 hours
Matching against the screening dataset	VerifyNow, Cape Town, South Africa	Per request
Enrollment link: name and our reference as keyed HMAC-SHA-256 digests. Never the passport or other ID number	VerifyNow, dedicated Redis in Cape Town, South Africa	While enrolled. Seven years after withdrawal
Full screening response, encrypted	VerifyNow, dedicated Redis in Cape Town, South Africa	48 hours
Quick check pack: Stripe Checkout ID, checks bought and used. No names	Cloudflare D1, restricted to the European Union	One year from purchase
Card, email, invoices, tax ID	Stripe	Per Stripe

Access controls

API keys are stored as hashes. Revoke a key and it stops working on the next call.

You can restrict a key to an IP allowlist. Until an owner adds addresses, any address is allowed. Set one in production.

Passwords are stored as hashes. Full screening responses are encrypted and deleted after 48 hours.