IAM integrations exchange limited user attributes and structured verification results
Customers may use the Services with an identity and access management platform such as Microsoft Entra or Okta to initiate identity verification as part of authentication or account-management workflows. In these integrations, the IAM platform may provide limited user attributes, such as name or other profile information, to Entrust to initiate verification, and may receive structured verification results, which may include verification outcomes and, where applicable and configured by the Customer, limited identity attributes, to support authentication and access decisions. Entrust processes personal data collected during identity verification primarily on the Customer's behalf, including in these integrations, and does not share identity documents, biometric data or underlying verification artifacts with the IAM platforms.
Details
Who
Entrust, the Customer and the IAM platform
What it does
exchanges limited user attributes and structured verification results
What it covers
limited profile attributes and verification outcomes/attributes, excluding identity documents, biometric data and underlying artifacts
Why
initiate identity verification and support authentication and access decisions
Condition
as configured by the Customer
Supporting quotations
Integrations with Identity and Access Management Platforms
The following describes how personal data may be exchanged in integrations with third-party platforms configured by Customers.
The Services may be used in conjunction with a Customer’s identity and access management platform (such as Microsoft Entra or Okta) to initiate identity verification as part of authentication or account management workflows.
In these integrations, the identity and access management platform may provide limited user attributes (such as name or other profile information) to Entrust to initiate verification and may receive structured verification results (which may include verification outcomes and, where applicable and configured by the Customer, limited identity attributes) to support authentication and access decisions.
Entrust processes personal data collected during identity verification primarily on behalf of the Customer, including when integrated with such platforms in accordance with Customer configuration, and does not share identity documents, biometric data, or underlying verification artifacts with such platforms.
Qualifications & exceptions
The exchange occurs in integrations configured by the Customer.
The IAM platform provides only limited user attributes to initiate verification.
Returned verification results may include limited identity attributes only where applicable and configured by the Customer.
Identity documents, biometric data and underlying verification artifacts are excluded from what Entrust shares with IAM platforms.
Not stated here
The notice does not enumerate every field included in 'structured verification results'; that depends on Customer configuration.
Entrust shares data with service providers, group companies, transaction parties, advisers, authorities and others
In addition to sharing with Customers and Data Providers, Entrust shares personal data with: third parties who help provide the Services and perform tasks on its behalf, including IT and infrastructure providers, data analytics providers and business process outsourcing partners whose staff perform human review and quality checks; companies in the Entrust group that help provide services, such as ancillary engineering, technical or customer support; an actual or potential buyer, investor or partner and its agents and advisers in relation to a business transaction; parties providing professional advice and services such as advisory and auditing; a competent law enforcement body, regulatory, government agency or court; and any other person where Entrust has a legitimate legal reason. The notice links to a current sub-processor list that is not part of the saved source.
Details
Who
Entrust
What it does
shares personal data with the listed recipient categories
What it covers
personal data, including data processed by service providers and group companies
Why
service delivery, business operations, transactions, advice and legal requests
Supporting quotations
Data Sharing and Use of Sub-Processors
In addition to sharing personal data with Customers and Data Providers (as described above), Entrust also shares personal data:
With third parties who help us provide the Services and perform tasks on our behalf. This includes information technology and related infrastructure providers (who provide us with a place to store your personal information); data analytics providers (who help us to analyze trends and provide market insights); and our business process outsourcing partners (whose staff perform human review and quality checks). For the current list of third-party service providers (“sub-processors”) who process User personal data to provide the Services, visit https://www.entrust.com/legal-compliance/data-privacy/sub-processors.
With companies in the Entrust group of companies who help us to provide our services (for example, by providing ancillary engineering, technical or customer support);
With an actual or potential buyer, investor or partner (and its agents and advisers) in relation to a business transaction;
With parties that provide Entrust with professional (e.g. advisory and auditing) advice and services;
With a competent law enforcement body, regulatory, government agency, or court;
To any other person where we have a legitimate legal reason for doing so.
Qualifications & exceptions
The third-party recipient list is illustrative of the categories described.
The current sub-processor list is provided by link and is not part of the saved source.
Entrust group companies are a separate recipient category from third-party sub-processors.
Not stated here
The linked sub-processor list is not part of the saved source, so the current recipients and their locations are not established here.
Entrust shares identity documents on Customer instruction, including with UK police for the Amberhill Database
Entrust shares personal data with any other person where a Customer instructs it to do so. For example, if a Customer has configured the Services to check whether an identity document has been previously identified as lost, stolen, fraudulent or otherwise compromised by a government or other external party, Entrust may share that compromised identity document on the Customer's behalf, and the government or other external party may retain a copy to the extent it considers necessary, proportionate and lawful. Under Customer instruction and as permitted by applicable law, Entrust currently shares identity documents with the UK Metropolitan Police as part of the Amberhill Database for these purposes.
Details
Who
Entrust, the Customer and external parties including UK Metropolitan Police
What it does
shares identity documents on Customer instruction
What it covers
compromised identity documents
Where
United Kingdom (Amberhill Database)
Condition
at Customer instruction and as permitted by applicable law
Supporting quotations
With any other person where instructed to do so by a Customer. For example, if a Customer has configured the Services to check whether an identity document has been previously identified as lost, stolen, fraudulent, or otherwise compromised by a government or other external party, Entrust may share that compromised identity document on behalf of that Customer, and the government or other external party may retain a copy to the extent they consider it necessary, proportionate, and lawful. Under the instruction of Customers and as permitted by applicable law, Entrust currently shares identity documents with the UK Metropolitan Police as part of the Amberhill Database for such purposes; and
Qualifications & exceptions
The sharing requires Customer instruction.
The external party's retention is described as to the extent it considers necessary, proportionate and lawful.
The Amberhill Database sharing is current and subject to applicable law.
Not stated here
The notice does not describe the full data set shared with the Amberhill Database or every participating external party.