Book a demo

Security & Compliance Measures · Last updated: 24 July 2026

How your personal data is protected

When processing identity data collected from end users going through a tenant's verification flow, IDotta acts as a Data Processor responsible for data security under UK GDPR and EU GDPR Art. 32. The list below summarizes the technical and administrative measures actually implemented in the platform.

This page is not marketing copy — every item corresponds to a verifiable control in the codebase.

  1. 01Single identifier: session_id

    The only user reference exposed externally is session_id. Personal data is never carried in a URL.

  2. 02Short-lived access tokens

    The tenant API key never reaches the browser. The WebSDK operates with a short-lived JWT, valid for 15 minutes by default.

  3. 03Role-based access control (RBAC)

    The admin panel has three permission levels — admin, tenant_admin, tenant_viewer — restricting access to tenant data on a least-privilege basis.

  4. 04Full audit trail

    Every session state transition is written to a timestamped event log. Even when a record is permanently deleted, a separate deletion log records who deleted it and when.

  5. 05Signed webhook notifications

    All result notifications are signed with HMAC-SHA256, letting the receiving system verify their origin.

  6. 06Replay protection

    Liveness checks use a single-use nonce with a time limit, per-session attempt caps, a session validity window, and a configurable CORS allowlist.

  7. 07Biometric data isolation

    Biometric records generated for face matching and liveness analysis are kept solely for verification and duplicate-detection purposes, and are permanently removed as part of PII deletion.

  8. 08Sandbox / production isolation

    Test environment data is fully separated from real production data via the environment field.

  9. 09Open-source sanctions screening

    AML checks use only publicly available lists (OFAC SDN, UN Consolidated, EU FSF, UK Sanctions List); identity data is never sent to a third-party commercial data vendor.

REGISTERED

ICO ZC273784Companies House 17478457

STANDARDS IMPLEMENTED

ICAO 9303OFAC · UN · EU · UKUK GDPR Art. 32EU hosting (Germany)

ROADMAP · NOT YET CERTIFIED

SOC 2 Type IIISO/IEC 27001eIDAS

Important note

This page is a technical summary of the measures in place and does not constitute legal advice. For binding terms on our processor obligations, refer to your tenant agreement or the data processing agreement executed with us.