Data & compliance
Designed to support your data protection obligations.
Data minimisation, masking, access control and audit logging help organisations implementing Indonesia's Personal Data Protection Law (UU PDP).
This page is not legal advice and not a claim of full UU PDP compliance. Customers remain responsible for determining the legal basis and compliance obligations for their use case.
Data handling
What is stored, and what is not
| Data | Status | Detail |
|---|---|---|
| Selfie & KTP images | Not stored | Processed in memory, discarded after the response |
| Face embeddings | Not stored | Never returned in responses |
| OCR field values | Not stored in records | Sent only to the caller; encrypted retry copy kept 24 h |
| NIK in analysis records | Masked | Last 4 digits, for support traceability |
| Registry lookup results | Stored encrypted | Cache keyed by hash |
| Decisions, reason codes, model versions | Stored | For audit and review resolution |
| Analysis details (clientRef, checks, notes) | Your retention period | 30 days to 5 years, then redacted; erasure on request via API |
| Repeat-identity index | Keyed fingerprints | No NIK or account number stored; per-workspace keys; 90-day expiry; can be switched off |
| Blocklist | Keyed fingerprints | Plus a 4-digit hint and your reason text |
You, as data controller
- Determine the legal basis and purpose
- Obtain consent or another lawful basis
- Inform users that verification happens
- Manage API key access in your organisation
- Handle deletion requests (erasure API available)
Us, as data processor
- Process data only for the verification you request
- Apply the controls on our Security page
- Keep an audit record of processing
- Discuss a data processing agreement with sales
Questions from legal or compliance?
We help your team get the answers they need.