Security & Safeguards · Procedure
One-Time Password confirms the User holds the phone number
The One-Time Password (“OTP”) service verifies that the User is in possession of the phone number by sending a unique code to that number for validation. It processes the telephone number and, where applicable, information related to the risk profile of that telephone number.
Details
- What it does
- sends a unique code to validate phone possession
Supporting quotations
| Categories of Personal Data: ● Telephone number; and | One-Time Password (“OTP”)
| ● Information related to the risk profile of a telephone number, where applicable | Verifies that the User is in possession of the phone number by sending a unique code to the User’s phone number for validation
Qualifications & exceptions
- Validation happens by sending a unique code to the User's phone number.
- Risk-profile information applies only where applicable.
Not stated here
- The notice does not state code lifetime, retry limits or delivery channels.
Security & Safeguards · Company commitment
Entrust pseudonymizes data where possible and applies security measures
Where possible, Entrust pseudonymizes, de-identifies and/or aggregates personal data to protect privacy and minimize security risks; it defines pseudonymized data as information replaced, transformed or removed so that it no longer identifies an individual without additional information. Entrust also takes appropriate administrative, physical, technical and organizational measures designed to help protect the information from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction, and points to a Guide to Security at Onfido for more information.
Details
- What it does
- pseudonymize, de-identify or aggregate where possible and apply organizational and technical measures
- Why
- protect privacy and minimize security risks
Supporting quotations
Where possible, we pseudonymize, de-identify and/or aggregate personal data to protect privacy and minimize security risks. Pseudonymized data is where we replace, transform, or remove information so that it no longer identifies an individual without additional information. Entrust also takes appropriate administrative, physical, technical and organizational measures designed to help protect the information it holds from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. For more information about information security in relation to the Onfido Identity Services, please visit the Guide to Security at Onfido.
Qualifications & exceptions
- Pseudonymization is described as happening 'where possible'.
- The measures are described as designed to help protect, not as a guarantee.
Not stated here
- The Guide to Security at Onfido is not supplied, and the notice names no specific standard, audit or breach-notification duty.