Data processing notice

When a customer calls a verification API, the customer is the personal information handler and decides the purpose and means. FIM processes the data on the customer’s request and for no other purpose.

The customer obtains the data subject’s consent before calling. Customers who need to keep verification records store the requestId and verdict in their own systems.

Only the fields needed for the check are processed. The result is one of match, mismatch or not found, and no submitted field is echoed. Fields travel only in the POST body, out of URLs and access logs.

Checks are completed through partner data providers. When signing a DPA we can describe the processors and their scope as needed.

Personal-data APIs must be enabled per app by an administrator; call logs are redacted; raw records are encrypted with a public key and every access is logged; upstream credentials are stored with AES-GCM; tenants are isolated. See Security for details.

If FIM finds a security incident that may affect customer data, we notify the affected customers promptly and help investigate and contain it.

After the engagement ends, call records are kept for the period agreed in the service contract and then deleted. Customers can set the period in the contract.