Security is our
foundation
We handle sensitive biometric and identity data. That responsibility shapes every decision we make—from architecture to team access.
Certifications & Compliance
Xident holds no third-party certification today. What exists is listed below.
Third-party certifications
None yet. Xident holds no ISO 27001, SOC 2 or other certification, audit or accreditation. This page describes what we do, not what a certifier has confirmed.
GDPR
A published Data Processing Agreement (Article 28). Xident's servers are in the EU (Hetzner, Germany and Finland); some sub-processors listed in the DPA are outside the EU.
Read the DPAUS state privacy law
A published US State Privacy Addendum with CCPA/CPRA service-provider terms.
Our age models were measured on 8,745 verified adults: see the numbers
Security Architecture
Defense in depth at every layer of our platform.
D Data Protection
Encryption at Rest
Sensitive data is encrypted using AES-256-GCM encryption at rest.
Encryption in Transit
TLS 1.3 for all data transmission. No exceptions.
Data Isolation
Customer data is logically isolated with tenant-level database filtering.
Secure Key Management
Secure key management using cloud provider key management services.
A Access Control
Role-Based Access
Granular permissions based on job function and least privilege.
Passkey Authentication
Passkey-based authentication for dashboard and admin panel access.
API Key Security
Constant-time comparison for API keys, with per-tenant key isolation.
Audit Logging
Comprehensive logs of all access and actions, retained for 1 year.
I Infrastructure
Cloud-Native Architecture
Built on modern infrastructure with automated failover and monitoring.
DDoS Protection
Enterprise-grade DDoS mitigation at network and application layers.
WAF Protection
Web application firewall blocking common attack vectors.
Security Assessments
Security assessments and code reviews performed regularly.
Data Handling
Transparency about what we collect, process, and retain.
| Data Type | How We Handle It | Retention |
|---|---|---|
| Biometric Data | Face embeddings are stored as 512-dimensional mathematical vectors, not photos. Original images are deleted after processing. | Tenant-chosen: 0, 30, 90, 180 or 365 days (default 365, the ceiling), or the life of the Xident account if shorter; then hard deleted |
| Document Data | ID documents are processed for age extraction. Document images are deleted when OCR completes, and in all cases within 24 hours of upload. | Deleted on OCR completion, at most 24 hours |
| Verification Results | Session metadata including verification outcome (over/under age), liveness result, IP, and timestamps. | 90 days |
| Verification Screen Events | Technical events from the verification screens, for example: device and browser type, screen, camera, upload and network state, photo quality, the result of the age check on the device and its confidence score, the liveness score, error codes, and short error messages with links, email addresses, long numbers and long codes removed. No images and no data read from the document. Only Xident staff can see them. | 90 days after the session ends |
| API Logs | Request logs for debugging and analytics. No biometric data in logs. | 90 days |
Responsible Disclosure
Found a security vulnerability? We appreciate your help keeping Xident secure. Please report issues responsibly.
Report a vulnerabilityWe respond to all reports within 24 hours. We take all reports seriously and will work with you to understand and resolve valid findings.
Need more details?
Enterprise customers can request our security documentation, questionnaire responses, and detailed architecture documentation.