Onfido Privacy Policy

Use & Processing · Company practice

Entrust handles Service data as the Customer's processor; Customers must explain that processing to Users

The Services help business Customers verify their Users' identities, carry out identity-related checks, or authenticate Users. When Entrust collects and processes personal data to provide those Services to a Customer, it acts on the Customer's behalf as their service provider and processor. The notice says Customers, not Entrust, are responsible for explaining this processing to their Users.

Supporting quotations

The Entrust Identity Verification Services (“Services”) help Customers verify their Users

When Entrust Corporation and its subsidiaries (“Entrust“) verifies an identity

When Entrust collects and processes personal data for the purpose of providing the Services to a Customer, Entrust acts on the Customer’s behalf as their service provider and processor.

NOTE: Customers are responsible for explaining this processing to their Users.

Qualifications & exceptions

• The processor role described applies to personal data processed for the purpose of providing the Services to a Customer.
• Entrust Corporation and its subsidiaries are referred to collectively as 'Entrust' in the notice.
• Entrust's separate controller-side processing is addressed by another card.

Cross-references

• contrast (model-proposed): Entrust also uses Service data as controller to develop, improve and analyze the Services — The same service data can be processed under two roles: Entrust acts as the Customer's processor to provide the Services, and separately as a controller for development and improvement uses. The notice keeps these roles distinct.

Use & Processing · Company practice

Entrust also uses Service data as controller to develop, improve and analyze the Services

Separately from its processor role, Entrust processes personal data on its own behalf as a controller. It may combine personal data collected while providing the Services with publicly available data to develop, improve, analyze, secure, test, validate and enhance the Services, including through analytics, automated processing, machine learning and artificial intelligence where permitted by applicable law. Onfido Ltd is the controller for this processing.

Supporting quotations

As well as handling personal data on behalf of a Customer for the purpose of providing the Services to them, Entrust also collects and processes personal data on our own behalf as a controller.

including through analytics, automated processing, machine learning, and artificial intelligence technologies where permitted by applicable law.

Onfido Ltd is the Controller for this processing.

Qualifications & exceptions

• Controller-side use is limited to where permitted by applicable law.
• The notice refers readers to its 'Using Personal Data as Controller' section for the purposes and legal bases of this processing.

Cross-references

• contrast (model-proposed): Entrust handles Service data as the Customer's processor; Customers must explain that processing to Users — The same service data can be processed under two roles: Entrust acts as the Customer's processor to provide the Services, and separately as a controller for development and improvement uses. The notice keeps these roles distinct.

Use & Processing · Company practice

Document Checks analyze identity documents to assess authenticity and signs of tampering

Part 3 describes Document Checks, which verify identity documents from across the globe by analyzing an image or video of the document. Entrust's system extracts information from the image/video or, where possible, from the document's security chip. Its models analyze authenticity, potentially including machine-readable zones, barcodes, QR codes and security chips, to determine whether the document is genuine or shows signs of tampering.

Supporting quotations

| Part 3. Entrust processes the data collected in (1) and (2), above and the following data, on behalf of the Customer to provide the Services |

Document Checks verify identity documents from across the globe by analyzing an image or video of the document. Our system extracts information from the image/video or, if possible, from the security chip embedded in the document. Our models analyze the authenticity of the document, which may include machine-readable zones, barcodes, QR codes, and security chips, to verify whether the document is genuine or shows signs of tampering.

Qualifications & exceptions

• Extraction from a security chip applies only 'if possible' for the document.
• The listed document features 'may include' those elements; they are not guaranteed for every document.

Cross-references

• qualifies (model-proposed): Document Checks compare identity documents with leaked or public compromised-identity data — The compromised-identity comparison is an additional step in the Document Checks process, alongside the authenticity and tampering analysis.

Use & Processing · Company practice

Entrust may mask Dutch BSN numbers when Dutch law requires it

For Users living in the Netherlands, Entrust may automatically mask the BSN number on their identity document in its back-end systems when required under Dutch law, particularly the Dutch Prevention of Money Laundering and Terrorist Financing Act.

Supporting quotations

NOTE: Users living in the Netherlands should be advised that Entrust may automatically mask the BSN number on their identity document in our back-end systems when required under Dutch law, and particularly the Dutch Prevention of Money Laundering and Terrorist Financing Act.

Qualifications & exceptions

• The masking applies to Users living in the Netherlands.
• Masking is discretionary ('may') and conditioned on a requirement under Dutch law.

Use & Processing · Company practice

Biometric checks compare face-geometry scans from a Selfie and a reference image

For biometric checks, Entrust asks for an image or video (which may include an audio recording) of the User's face (a 'Selfie') and an image or video to use as a reference, such as an image of their identity document. It generates two scans of the User's face geometry, one from the Selfie and one from the reference image, and compares them to assess whether the person in the Selfie is likely to be the same person pictured in the reference image. Entrust also evaluates the authenticity of the images, videos and identity documents, including detecting whether a genuine human or physical document is present and identifying signs of tampering, coercion or social engineering.

Supporting quotations

| Biometric Checks and Authentication These services involve the processing of data that may be considered biometric identifiers or biometric information under applicable laws When providing biometric checks as part of our Services, we’ll ask for an image or video (which may include an audio recording) of a User’s face (a “Selfie”), as well as an image or video to use as a reference image (for example, an image of their identity document). We generate two scans of the User’s face geometry (one scan using the Selfie, and one scan using the reference image) and we compare those two scans to assess whether the person in the Selfie is likely to be the same person

We will also evaluate the authenticity of the images and videos (including audio recordings) and identity documents, including detecting whether there is a genuine human or physical document in the images/videos, and identifying signs of tampering, coercion or social engineering.

Qualifications & exceptions

• The comparison assesses whether the person is 'likely to be' the same, not a certainty.
• The Selfie image or video may include an audio recording.
• The reference image is exemplified by, but not limited to, an identity document.

Cross-references

• qualifies (model-proposed): Extracted face scans are not kept after a check, except for fraud checks — The comparison generates face-geometry scans, while the retention rule limits their storage after the check, except for the fraud-check services.

Use & Processing · Company practice

Facial Similarity Check - Selfie compares an ID or reference face with a Selfie image

Facial Similarity Check - Selfie compares the face displayed on an identity document or reference image with an image of the User's face to verify that they are the same. The listed data is an image of the User's face, an image of the face in the identity document or reference image, and scans of face geometry.

Supporting quotations

| Categories of Personal Data: ● Image of the User’s face ● Image of the face in the identity document / reference image ● Scans of face geometry | Facial Similarity Check - Selfie Compares the face displayed on an identity document or reference image with an image of the User’s face, to verify that they are the same. |

Qualifications & exceptions

• The comparison is between the reference-image face and the Selfie image.

Use & Processing · Company practice

Facial Similarity Check - Video compares a facial scan from video and performs liveness detection, with mandatory audio

Facial Similarity Check - Video compares the face displayed on an identity document or reference image with a facial scan captured from a video of the User to verify that they are the same, while also performing liveness detection. The notice says this includes mandatory processing of audio. Its data includes video of the User with audio recording, images of the reference face, transcribed text data from the video clip, and data that may be biometric identifiers or information such as face-geometry scans or voiceprints.

Supporting quotations

| Categories of Personal Data: ● Video of the User (including audio recording) ● Image of the face in the identity document / reference image ● Transcribed text data from the video clip ● Data that may be considered biometric identifiers or biometric information (e.g., scans of face geometry or voiceprints) | Facial Similarity Check - Video Compares the face displayed on an identity document or reference image with a facial scan captured from a video of the User, to verify that they are the same while also performing liveness detection. Includes mandatory processing of audio. |

Qualifications & exceptions

• Audio processing is mandatory for this check.
• The video check also performs liveness detection.

Use & Processing · Company practice

Autofill classifies identity documents and returns OCR-extracted human-readable data

Autofill classifies identity documents and, using optical character recognition technology, returns automatically extracted human-readable data from the identity document. The listed data is an image of the identity document and information describing it.

Supporting quotations

| Categories of Personal Data: • Image of the identity document and information describing the identity document | Autofill Classifies identity documents and using optical c h a r a c t e r r e c o g n i t i o n t e c h n o l o g y , returns automatically extracted human- readable data from the identity document. |

Qualifications & exceptions

• The extraction is automatic and uses optical character recognition.

Use & Processing · Company practice

Some fraud checks depend on the selected Services; others apply across all Services

Entrust uses several fraud detection capabilities. Some depend on the scope of the Services the Customer selected, while other fraud checks are applied across all the Services. An example given is analyzing metadata associated with the User's Selfie and the image or video of their identity document to identify whether editing software can be detected, as part of assessing the likelihood that the User is genuine.

Supporting quotations

| Fraud checks, including device integrity and fraud signals Entrust leverages several different fraud detection capabilities. Some of these depend on the scope of the Services selected by the Customer, whereas other fraud checks are applied across all the Services.

(For example, Entrust will analyze the metadata associated with the User’s Selfie and the image or video of their identity document (to identify whether any editing software can be detected) to assess the likelihood that the User is genuine.)

Qualifications & exceptions

• The split between service-specific and all-service fraud checks varies by capability.
• The metadata analysis example assesses likelihood; it is not stated as conclusive proof of editing.

Not stated here

• The notice does not enumerate which fraud checks apply to every Service.

Use & Processing · Company practice

Authentication services store a face scan in an Encrypted Biometric Token held by Entrust and the Customer

For Authentication: Motion, Face Authentication and Biometric Passkey, a Customer may instruct Entrust to generate a scan of a User's face geometry from an image/video of the User or their identity document. Entrust embeds the scan in an Encrypted Biometric Token (EBT) stored by Entrust and by the Customer, either on the Customer's infrastructure or on the User's device. For authentication, the Customer may instruct Entrust to compare the scan in the EBT with a scan generated from a separate image or video; if the two match, the User is authenticated. Separately, Customers may associate the EBT with a passkey generated and managed in their own environment for passwordless authentication. The maximum period a Customer may instruct Entrust to store and use face scans for these services is 365 days after the Company or User submitted the image/video used to generate the scan.

Supporting quotations

Authentication: Motion, Face Authentication, and Biometric Passkey. A Customer may instruct Entrust to generate a scan of a User’s face geometry using an image / video of the User or their identity document. Entrust embeds the scan in an Encrypted Biometric Token (“EBT”) that is stored by Entrust and by the Customer (either on the Customer’s infrastructure or on the User’s device).

For Authentication, the Customer may instruct Entrust to compare the scan embedded in the EBT with a scan of the User’s face geometry generated from a separate image or video of the User. If the two scans match, the User is authenticated.

Separately, Customers may associate the EBT with a passkey generated and managed in their own environment to support passwordless authentication.

The maximum period of time for which a Customer may instruct Entrust to store and use face scans for the purpose of these services is three-hundred and sixty-five (365) days after the Company or the User submitted to Entrust the image / video used to generate the face scan.

Qualifications & exceptions

• Generation and comparison occur on Customer instruction.
• The EBT is stored by Entrust and by the Customer, on the Customer's infrastructure or the User's device.
• Passkeys are generated and managed in the Customer's own environment.
• The 365-day maximum applies to Authentication: Motion, Face Authentication and Biometric Passkey among the listed services.

Not stated here

• The notice does not describe the encryption or key-management details of the EBT.

Use & Processing · Company practice

Liveness Verification confirms physical presence through a passive facial capture without identity matching

Liveness Verification confirms a User's physical presence through a real-time passive facial capture, without performing identity matching. A Customer may instruct Entrust to generate a scan of the User's face geometry from an image or video of the User to assess whether the User is physically present. If the Customer requests it, the scan may be embedded in an Encrypted Biometric Token and stored by Entrust and/or the Customer, on the Customer's infrastructure or the User's device. The maximum period a Customer may instruct Entrust to store and use face scans for these services is 365 days after the Company or User submitted the image/video used to generate the scan.

Supporting quotations

Liveness Verification. Entrust can confirm a User’s physical presence through a real-time passive facial capture, without performing identity matching. A Customer may instruct Entrust to generate a scan of User’s face geometry using an image or video of the User for the purpose of assessing whether the User is physically present. If requested by the Customer, the scan may be embedded in an Encrypted Biometric Token (“EBT”) and stored by Entrust and/or the Customer (either on the Customer’s infrastructure or on the User’s device).

The maximum period of time for which a Customer may instruct Entrust to store and use face scans for the purpose of these services is three-hundred and sixty-five (365) days after the Company or the User submitted to Entrust the image / video used to generate the face scan.

Qualifications & exceptions

• Liveness Verification does not perform identity matching.
• The facial capture is real-time and passive.
• EBT storage occurs only if requested by the Customer.
• The 365-day maximum applies to Liveness Verification among the listed services.

Use & Processing · Company practice

Authentication: Motion and Face Authentication compare an EBT face scan with video and check liveness

Authentication: Motion and Face Authentication each use an image or video of the User or their identity document to generate a face-geometry scan embedded in an Encrypted Biometric Token. The service compares that face scan with a facial image captured from a video of the User to verify that they are the same, while also performing liveness detection. Both include optional processing of audio. Their listed data is video of the User including background audio at the Customer's option, the face image in the identity document or reference image, transcribed text from the video clip if applicable, scans of face geometry and data that may be considered a voiceprint. The notice describes the two rows with the same data and processing.

Supporting quotations

| Categories of Personal Data ● Video of the User (including background audio recording at Customer’s option) ● Image of the face in the identity document / reference image ● Transcribed text from the video clip (if applicable) ● Scans of face geometry ● Data that may be considered a voiceprint | Authentication: Motion Uses an image/video of the User / their identity document to generate a scan of face geometry which is embedded in an EBT and compares that face scan with a facial image captured from a video of the User, to verify that they are the same, while also performing liveness detection. Includes optional processing of audio. |

| Categories of Personal Data ● Video of the User (including background audio recording at Customer’s option) ● Image of the face in the identity document / reference image ● Transcribed text from the video clip (if applicable) ● Scans of face geometry ● Data that may be considered a voiceprint | Face Authentication Uses an image/video of the User / their identity document to generate a scan of face geometry which is embedded in an EBT and compares that face scan with a facial image captured from a video of the User, to verify that they are the same, while also performing liveness detection. Includes optional processing of audio. |

Qualifications & exceptions

• Audio processing is optional, with background audio recorded at the Customer's option.
• The notice describes Authentication: Motion and Face Authentication with identical data and processing text.
• The 365-day face-scan storage maximum stated for these services applies.

Not stated here

• The notice does not state how the EBT is protected or what happens when the comparison fails.

Use & Processing · Context

Reports aim to help Customers make informed decisions and help Users who have difficulty passing a check

Entrust says that by providing detailed Reports, it aims to empower Customers to make informed decisions about their Users and to provide help to Users who are having difficulty passing a check.

Supporting quotations

By providing our customers with these detailed Reports, our aim is to empower our Customers to make informed decisions about their Users and to provide help to Users that are having difficulty in passing a check.

Qualifications & exceptions

• This is a statement of aim, not an obligation to achieve a particular outcome for a User.

Use & Processing · Company practice

Entrust uses Service data to improve and develop the Services unless applicable law prohibits it

Provided it is not prohibited by applicable law, Entrust uses personal data it collects about Customers' Users to improve and develop the Services. For the same purpose, it may also use personal information that has been made publicly available or obtained from a third party, again provided this is not prohibited by applicable law.

Supporting quotations

To develop and improve the Services (including machine learning technologies)

At Entrust, our vision is to simplify digital identity. Provided it is not prohibited by applicable law, we use personal data we collect about our Customers’ Users (as described above) to improve and develop the Services. For the same purpose, we may also use personal information that has been made publicly available or that we have obtained from a third party provided this is not prohibited by applicable law.

Qualifications & exceptions

• Both uses are conditioned on not being prohibited by applicable law.
• Publicly available or third-party information may be used for the same improvement purpose.

Cross-references

• defines (model-proposed): Development includes training ML models and human analysts and re-running checks for quality — The development-activities card defines what improving and developing the Services includes: technology and model building, analyst training, and quality re-runs.